CVE-2016-3054: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM FileNet Workplace 4.0.2 allows remote authenticated users to inject arbitrary web script or HTML by uploading a file...

PT-2016-6719

Name of the Vulnerable Software and Affected Versions IBM FileNet Workplace version 4.0.2 before 4.0.2.14 Description The issue allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks. Recommendations For IBM FileNet Workplace version 4.0.2 before...

PT-2016-5343

Name of the Vulnerable Software and Affected Versions IBM FileNet Workplace version 4.0.2 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML by uploading a file. This occurs because the software does not properly validate or...

IBM FileNet Workplace Phishing Attack Vulnerability

IBM FileNet is the enterprise content management platform of IBM Corporation of the U.S.A. IBM FileNet Workplace is one of the set of client-side Web applications that provide access to document management and business process management. A phishing attack vulnerability exists in IBM FileNet...

IBM FileNet WorkPlace Open Redirect Vulnerability

IBM FileNet is the enterprise content management platform of IBM Corporation of the U.S.A. IBM FileNet Workplace is one of the set of client-side Web applications that provide access to document management and business process management. An open redirection vulnerability exists in IBM FileNet...

Managed Workplace Service Center 4.x/5.x/6.x Installation Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27702/info Managed Workplace Service Center is prone to an information-disclosure vulnerability because the application fails to protect private information. Attackers may exploit this issue to retrieve sensitive...

Dropbox Patches Shared Links Privacy Vulnerability

Dropbox has acknowledged and disabled a vulnerable shared links feature that exposed documents stored by the service to third parties. Shared links are a collaboration feature that allows user, especially in a business environment, to share and edit documents. Dropbox rival Intralinks reported th...

CVE-2013-4600: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to system/workplace/views/admin/admin-main.jsp or the 2 requestedResource parameter to system/login/index.html...

Facebook Allowing VIPs To Verify Accounts, Use Nicknames

Lady Gaga and Carrothead rejoice: with a tweak of its ‘real name’ policy, Facebook will allow high profile members to verify their account and begin using nicknames or pseduonym to identify themselves. The company says the new feature will allow celebrities and other Facebook VIPs to get higher...

JVN#97334690: IBM Lotus vulnerable to denial-of-service (DoS)

IBM Lotus product line contains a denial-of-service DoS vulnerability due to an issue in Java Runtime Environment JRE. Impact A remote attacker may cause a denial-of-service DoS. Solution Apply a patch Apply the appropriate patch according to the information provided by the developer. Products...

Experts Agree: No Easy Fix For Mobile Security

SAN FRANCISCO — Mobile phones, tablet PCs and other new technologies are poised to take over the workplace, but organizations that hope to secure them before they do so face an uphill battle, according to a symposium on mobile security. Experts at the half day mobile security event on Monday warn...

CVE-2009-4999

Cross-site scripting XSS vulnerability in the Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-016 allows remote attackers to inject arbitrary web script or HTML via the Name field...

CVE-2009-5001

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.2-P8AE-FP002 grants a document's Creator-Owner full control over an annotation object, even if the default instance security has changed, which might allow remote authenticated users to bypass intended...

CVE-2009-5002

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.1-P8AE-FP001 does not record Get Content Failure Audit events, which might allow remote attackers to attempt content access without detection...

CVE-2010-3470

Multiple cross-site scripting XSS vulnerabilities in the Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-021 and 4.0.2.x before 4.0.2.7-P8AE-FP007 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-3471

Session fixation vulnerability in the Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.7-P8AE-FP007 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2006-7242

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-001 does not ensure that the AE Administrator role is present for Site Preferences modifications, which allows remote authenticated users to bypass intended access restrictions via unspecified vectors...

CVE-2008-7261

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 3.5.1 before 3.5.1-010 records DEBUG messages containing user credentials in the log4j.xml file, which might allow local users to obtain sensitive information by reading this file...

CVE-2009-5002

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.1-P8AE-FP001 does not record Get Content Failure Audit events, which might allow remote attackers to attempt content access without detection...

CVE-2009-5000

Multiple cross-site scripting XSS vulnerabilities in the Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.3-P8AE-FP003 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to .jsp pages...