CVE-2016-2938

IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-3018

IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

IBM Security Identity Manager Virtual Appliance Cross-Site Scripting Vulnerability (CNVD-2017-00457)

IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. A cross-site scripting vulnerability exists in the IBM Security Identity Manager Virtual Appliance. An attacker can exploit this vulnerability to inject arbitrary JavaScrip...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM WAS. An...

Cross-site scripting vulnerability in multiple IBM Rational products (CNVD-2016-13286)

IBM Rational Collaborative Lifecycle Management CLM, etc. are products of IBM Corporation in the U.S. IBM Rational CLM, Rational Team Concert RTC and Rational Engineering Lifecycle Manager RELM are collaborative lifecycle management solutions; Rational DOORS Next Generation RDNG is a requirements...

IBM Business Process Manager Cross-Site Scripting Vulnerability (CNVD-2016-13273)

IBM Business Process Manager BPM is a comprehensive set of business process management platform from IBM in the United States. The platform provides a range of tools related to process modeling, assembly, monitoring and deployment for business. A cross-site scripting vulnerability exists in IBM...

U.S. Dept Of Defense: DOM Based XSS on a DoD website

A DoD website was vulnerable to a DOM based cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. @juliocesar was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: XSS vulnerability on an Army website

A U.S. Army website was vulnerable to a cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. spam404 was able to demonstrate this vulnerability by crafting a specially formatted...

U.S. Dept Of Defense: Reflected XSS on an Army website

A U.S. Army website was vulnerable to a cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. juliocesar was able to demonstrate this vulnerability by crafting a specially formatte...

U.S. Dept Of Defense: Reflected XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @yaworskwas able to demonstrate this vulnerability by crafting a specially...

FUDforum 3.0.6 - Local File Inclusion

FUDforum 3.0.6 - Local File Inclusion Security Advisory - Curesec Research Team 1. Introduction Affected Product: FUDforum 3.0.6 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://fudforum.org/forum/ Vulnerability Type: LFI Remote Exploitable: Yes Reported to vendor: 04/11/2016...

FUDforum 3.0.6 Local File Inclusion

Security Advisory - Curesec Research Team 1. Introduction Affected Product: FUDforum 3.0.6 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: http://fudforum.org/forum/ Vulnerability Type: LFI Remote Exploitable: Yes Reported to vendor: 04/11/2016 Disclosed to public: 11/10/2016 Release...

CVE-2016-5920

Cross-site scripting XSS vulnerability in the Web UI in IBM Financial Transaction Manager FTM for ACH Services 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

IBM TRIRIGA Application Platform Cross-Site Scripting Vulnerability

The IBM TRIRIGA Application Platform is a set of technology platforms for deploying TRIRIGA applications from IBM in the United States. The platform provides a set of design-time and run-time components for building and running its enterprise applications, respectively, and supports...

IBM Multi-Enterprise Integration Gateway and B2B Advanced Communications Cross-Site Scripting Vulnerability

IBM Multi-Enterprise Integration Gateway MEIG and IBM B2B Advanced Communications are both products of IBM Corporation, U.S.A. IBM MEIG is a cross-enterprise integration communications gateway product.IBM B2B Advanced IBM MEIG is a cross-enterprise integrated communications gateway product.IBM B2...

IBM Business Process Manager Advanced Cross-Site Scripting Vulnerability

IBM Business Process Manager Advanced is a unified platform for analyzing and improving business operations. A cross-site scripting vulnerability exists in IBM BPM Advanced versions 8.5.6.0 through 8.5.7.0. A remote attacker can exploit this vulnerability to inject arbitrary JavaScript code into...

CVE-2016-5974

Cross-site scripting XSS vulnerability in the Web UI in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string...

CVE-2016-5944

Cross-site scripting XSS vulnerability in the Web UI in IBM Spectrum Control formerly Tivoli Storage Productivity Center 5.2.x before 5.2.11 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string...

CVE-2016-3001

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3003 and CVE-2016-3006...

CVE-2016-3006

Cross-site scripting XSS vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3003...