Lucene search

K

IBM Corporation Security Vulnerabilities

cve
cve

CVE-2016-8981

IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the...

5.5CVSS

5.2AI Score

0.0004EPSS

2017-02-01 08:59 PM
13
cve
cve

CVE-2016-8943

IBM Tivoli Storage Productivity Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.6AI Score

0.0005EPSS

2017-02-01 08:59 PM
23
cve
cve

CVE-2016-8980

IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory...

8.1CVSS

8.1AI Score

0.001EPSS

2017-02-01 08:59 PM
14
cve
cve

CVE-2016-6080

The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the...

5.3CVSS

5AI Score

0.001EPSS

2017-02-01 08:59 PM
27
cve
cve

CVE-2016-8918

IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid...

5.9CVSS

5.6AI Score

0.002EPSS

2017-02-01 08:59 PM
14
cve
cve

CVE-2016-8913

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the...

6.5CVSS

6.9AI Score

0.001EPSS

2017-02-01 08:59 PM
13
cve
cve

CVE-2016-6054

IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.2AI Score

0.0005EPSS

2017-02-01 08:59 PM
22
cve
cve

CVE-2016-8936

IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

6.1CVSS

5.9AI Score

0.001EPSS

2017-02-01 08:59 PM
18
cve
cve

CVE-2016-8942

IBM Tivoli Storage Productivity Center could allow an authenticated user with intimate knowledge of the system to edit a limited set of properties on the...

3.1CVSS

4.7AI Score

0.0005EPSS

2017-02-01 08:59 PM
15
cve
cve

CVE-2016-6059

IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory...

8.1CVSS

8.1AI Score

0.001EPSS

2017-02-01 08:59 PM
27
cve
cve

CVE-2016-6084

IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema...

6.5CVSS

6.8AI Score

0.001EPSS

2017-02-01 08:59 PM
17
cve
cve

CVE-2016-8922

Exphox WebRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

6.1CVSS

6AI Score

0.001EPSS

2017-02-01 08:59 PM
22
cve
cve

CVE-2016-8941

IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website...

8.8CVSS

8.6AI Score

0.001EPSS

2017-02-01 08:59 PM
18
cve
cve

CVE-2016-6123

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.7AI Score

0.0005EPSS

2017-02-01 08:59 PM
14
cve
cve

CVE-2016-6085

IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay...

6.5CVSS

6.8AI Score

0.001EPSS

2017-02-01 08:59 PM
21
cve
cve

CVE-2016-6090

IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized administrative operations, and potentially causing a denial of...

9.8CVSS

9AI Score

0.004EPSS

2017-02-01 08:59 PM
14
cve
cve

CVE-2016-6125

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.7AI Score

0.0005EPSS

2017-02-01 08:59 PM
14
cve
cve

CVE-2016-8921

IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable...

8.8CVSS

8.9AI Score

0.009EPSS

2017-02-01 08:59 PM
23
cve
cve

CVE-2016-6124

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable...

8.8CVSS

8.9AI Score

0.009EPSS

2017-02-01 08:59 PM
17
cve
cve

CVE-2016-8934

IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.3AI Score

0.0005EPSS

2017-02-01 08:59 PM
33
cve
cve

CVE-2016-6047

IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.2AI Score

0.0005EPSS

2017-02-01 08:59 PM
19
cve
cve

CVE-2016-6082

IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary code on the...

10CVSS

9.6AI Score

0.009EPSS

2017-02-01 08:59 PM
21
cve
cve

CVE-2016-8911

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

5.4CVSS

6.1AI Score

0.001EPSS

2017-02-01 08:59 PM
26
cve
cve

CVE-2016-8912

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated...

4.3CVSS

5.2AI Score

0.0005EPSS

2017-02-01 08:59 PM
14
4
cve
cve

CVE-2016-8920

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.7AI Score

0.0005EPSS

2017-02-01 08:59 PM
13
cve
cve

CVE-2016-6122

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 discloses answers to security questions in a response to authenticated...

4.3CVSS

5.3AI Score

0.0005EPSS

2017-02-01 08:59 PM
21
cve
cve

CVE-2016-6072

IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.2AI Score

0.0005EPSS

2017-02-01 08:59 PM
16
cve
cve

CVE-2016-6061

IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.2AI Score

0.0005EPSS

2017-02-01 08:59 PM
24
cve
cve

CVE-2016-6113

IBM Verse is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

6.1CVSS

5.9AI Score

0.001EPSS

2017-02-01 08:59 PM
19
cve
cve

CVE-2016-6065

IBM Security Guardium Database Activity Monitor appliance could allow a local user to inject commands that would be executed as...

7.8CVSS

7.4AI Score

0.0004EPSS

2017-02-01 08:59 PM
22
cve
cve

CVE-2016-6126

IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the...

6.5CVSS

6.9AI Score

0.001EPSS

2017-02-01 08:59 PM
17
cve
cve

CVE-2016-5950

IBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read by an authenticated...

6.5CVSS

6.7AI Score

0.001EPSS

2017-02-01 08:59 PM
17
cve
cve

CVE-2016-6045

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website...

8.8CVSS

8.6AI Score

0.001EPSS

2017-02-01 08:59 PM
19
cve
cve

CVE-2016-6040

IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being...

5CVSS

4.9AI Score

0.001EPSS

2017-02-01 08:59 PM
17
cve
cve

CVE-2016-5937

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website...

8.8CVSS

8.6AI Score

0.001EPSS

2017-02-01 08:59 PM
26
cve
cve

CVE-2016-5980

IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.2AI Score

0.0005EPSS

2017-02-01 08:59 PM
19
cve
cve

CVE-2016-5899

IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.2AI Score

0.0005EPSS

2017-02-01 08:59 PM
21
cve
cve

CVE-2016-5939

IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end...

6.3CVSS

6.8AI Score

0.001EPSS

2017-02-01 08:59 PM
15
cve
cve

CVE-2016-5966

IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

5.9CVSS

5.8AI Score

0.001EPSS

2017-02-01 08:59 PM
19
cve
cve

CVE-2016-6043

Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being...

7CVSS

7.1AI Score

0.0004EPSS

2017-02-01 08:59 PM
21
cve
cve

CVE-2016-6030

IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.2AI Score

0.0005EPSS

2017-02-01 08:59 PM
19
cve
cve

CVE-2016-6046

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.6AI Score

0.0005EPSS

2017-02-01 08:59 PM
25
cve
cve

CVE-2016-6028

IBM Jazz technology based products might allow an attacker to view work item titles that they do not have privilege to...

4.3CVSS

4.7AI Score

0.0005EPSS

2017-02-01 08:59 PM
18
cve
cve

CVE-2016-5897

IBM Jazz Reporting Service (JRS) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting...

5.4CVSS

5.6AI Score

0.001EPSS

2017-02-01 08:59 PM
23
cve
cve

CVE-2016-6039

IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.2AI Score

0.0005EPSS

2017-02-01 08:59 PM
15
cve
cve

CVE-2016-6042

IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system in.....

7.3CVSS

7.4AI Score

0.003EPSS

2017-02-01 08:59 PM
22
cve
cve

CVE-2016-5964

IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account...

9.8CVSS

9AI Score

0.004EPSS

2017-02-01 08:59 PM
20
cve
cve

CVE-2016-5952

IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end...

8.8CVSS

8.8AI Score

0.001EPSS

2017-02-01 08:59 PM
25
cve
cve

CVE-2016-5948

IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

5.4CVSS

5.7AI Score

0.0005EPSS

2017-02-01 08:59 PM
19
cve
cve

CVE-2016-5958

IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture.....

7.5CVSS

7.3AI Score

0.002EPSS

2017-02-01 08:59 PM
24
Total number of security vulnerabilities288