CVE-2019-4403

IBM Connections 6.0 is affected by a cross-site scripting (XSS) vulnerability in the Web UI, allowing an attacker to embed arbitrary JavaScript to alter functionality and potentially disclose credentials within a trusted session. The root cause cited in CNVD-2019-19316 is lack of proper validatio...

CVE-2017-1748

CVE-2017-1748 affects IBM Connections 5.0, 5.5, and 6.0. The vulnerability is an open redirect that could be exploited remotely to spoof the URL shown to a victim and redirect to a malicious site, enabling phishing and potential data leakage. IBM X-Force ID: 135521. No remediation details are pro...

CVE-2015-5038

CVE-2015-5038 affects IBM Connections 3.x (before 3.0.1.1 CR3), 4.0 (before CR4), 4.5 (before CR5), and 5.0 (before CR3). It reports a flaw in XML entity expansion recursion that can be exploited by a crafted XML document with many nested entities to trigger denial of service (CPU consumption and...

CVE-2016-3007

CVE-2016-3007 is a CSRF vulnerability in IBM Connections affecting versions 4.x up to 4.5 CR5, 5.0 before CR4, and 5.5 before CR1. The issue allows remote authenticated users to hijack the authentication of arbitrary users. Connected documents confirm the vendor/product (IBM Connections) and the ...

CVE-2018-1935

IBM Connections versions 5.0, 5.5, and 6.0 are affected by an information disclosure vulnerability where an authenticated user can obtain sensitive information from invalid request error messages. Root cause details are not provided beyond the error-message behavior in the cited sources. Impact i...

CVE-2016-2954

CVE-2016-2954 is an XSS vulnerability in the IBM Connections Web UI. Affects IBM Connections 5.0 before CR4 and 5.5 before CR1; remote authenticated users can inject arbitrary web script or HTML via unspecified vectors. This entry is differentiated from CVE-2016-2956 and CVE-2016-3008. The provid...

CVE-2015-5035

IBM Connections is affected by a cross-site scripting (XSS) vulnerability (CVE-2015-5035) in 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3. The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. The provided connected doc...

CVE-2016-3003

IBM Connections Web UI suffers a Cross‑Site Scripting (XSS) vulnerability in versions 4.x up to 4.5 CR5, 5.0 before CR4, and 5.5 before CR1. The issue allows remote authenticated users to inject arbitrary script or HTML via an embedded string, as documented across multiple sources (NVD entries CV...

CVE-2015-5036

CVE-2015-5036 is an XSS vulnerability in IBM Connections affecting 3.x (before 3.0.1.1 CR3), 4.0 (before CR4), 4.5 (before CR5), and 5.0 (before CR3). The issue allows remote authenticated users to inject arbitrary script/HTML via a crafted URL. Connected sources confirm IBM Connections as the af...

CVE-2016-2955

CVE-2016-2955 is an XSS vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Affected products/versions: IBM Connections 5.0 (pre-CR4) and 5.5 (pre-CR1). The connected source...

CVE-2017-1613

CVE-2017-1613 affects IBM Connections 6.0 (Engagement Center). A remote, unauthenticated attacker could access non‑sensitive Engagement Center template data. Root cause and exact exploit details are not provided in the documents; exploitation status is listed as null in the sources. No remediatio...

CVE-2018-1791

CVE-2018-1791 affects IBM Connections versions 5.0, 5.5, and 6.0. The vulnerability stems from improper validation of a request property, enabling an External Service Interaction where an attacker could cause the Connections server to attack other systems. Public sources (NVD/IBM X-Force) assign ...

CVE-2014-0929

IBM Connections Profiles component (through version 3.0.1.1 CR3) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability that allows remote authenticated users to hijack the authentication of arbitrary users for follow actions. Root cause: CSRF in/profile follow actions. Exploitation det...

CVE-2016-2953

CVE-2016-2953 affects IBM Connections 4.0–CR4, 4.5–CR5, and 5.0 before CR4, where SSL is not required, allowing remote attackers to obtain sensitive cleartext information by sniffing the network. The NVD entry documents network-based information disclosure with CVSS v3.0/3.0 metrics (AV:N/AC:H/PR...

CVE-2017-1498

CVE-2017-1498 concerns IBM Connections 5.5, where the Web UI is vulnerable to cross-site scripting. The provided documents identify XSS as the issue, allowing an attacker to embed arbitrary JavaScript in the Web UI and potentially disclose credentials within a trusted session. Affected product: I...

CVE-2016-0305

CVE-2016-0305 affects IBM Connections, where a cross-site scripting vulnerability arises from improper validation of user-supplied input. A remote attacker can lure a user to click a specially crafted URL, causing script execution in the victim’s browser within the hosting site's security context...

CVE-2016-3009

CVE-2016-3009 describes a CSRF vulnerability in IBM Connections (versions 4.0–CR4, 4.5–CR5, and 5.0 before CR4) where remote authenticated users can hijack the authentication of arbitrary users for requests that modify the Connections generic page. The connected documents confirm the affected pro...

CVE-2015-7461

CVE-2015-7461 describes an XML external entity (XXE) vulnerability in IBM Connections versions 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 prior to CR4. The issue allows remote authenticated users to trigger a denial of service through crafted XML data, causing memory consumption. The vulnerability’s ...

CVE-2016-2958

The CVE-2016-2958 entry affects IBM Connections: versions 4.0–CR4, 4.5–CR5, and 5.0 before CR4. The vulnerability is an information disclosure where remote authenticated users can obtain sensitive data by reading an "archaic" e‑mail address returned in a response. Root cause is exposure of a data...

CVE-2016-3000

The CVE-2016-3000 entry concerns IBM Connections with a DoS in the Help Service. The affected products/versions stated are IBM Connections 4.x up to 4.5 CR5, 5.0 before CR4, and 5.5 before CR1. The vulnerability allows remote authenticated users to cause service degradation via a crafted URL. The...

CVE-2016-3006

CVE-2016-3006 is a Cross-Site Scripting (XSS) vulnerability in the IBM Connections Web UI. Affected software includes IBM Connections versions 4.x up to 4.5 CR5, 5.0 up to CR4, and 5.5 up to CR1. The issue allows remote authenticated users to inject arbitrary web script or HTML via an embedded st...

CVE-2016-3010

CVE-2016-3010 is a cross-site scripting (XSS) vulnerability affecting IBM Connections Web UI. The issue spans IBM Connections versions 4.0–CR4, 4.5–CR5, 5.0 before CR4, and 5.5 before CR1, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The desc...

CVE-2015-7459

IBM Connections (versions 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4) contains a Cross‑Site Scripting (XSS) vulnerability. The root cause is failure to properly validate user-submitted input, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. This is ...

CVE-2016-0310

CVE-2016-0310 affects IBM Connections 5.5 and earlier. The vulnerability is a host header injection flaw that can cause navigation to the attacker’s domain. Root cause noted in CNVD records: the program fails to properly validate HTTP request headers, enabling manipulation via the Host header. Ex...

CVE-2016-2997

Technical details about CVE-2016-2997 are not provided in the supplied documents. No concrete vendor/product/version data or exploit information is available here. Monitor for updates from official advisories.

CVE-2016-3005

The CVE-2016-3005 entry describes a Cross-site scripting (XSS) vulnerability in the Web UI of IBM Connections across several versions: 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspe...

CVE-2018-1896

IBM Connections versions 5.0, 5.5, and 6.0 are described as vulnerable to a host header injection that could cause navigation to the attacker’s domain. The available connected documents consistently identify this as a host header injection issue but do not provide concrete details on affected com...

CVE-2016-5932

Technical details such as affected components, versions, root cause, and remediation are not publicly provided in the supplied connected documents. Monitor for updates.

CVE-2015-7460

CVE-2015-7460 describes a cross-site scripting (XSS) vulnerability in IBM Connections versions 3.0.1.1 and earlier, and 4.0, 4.5, and 5.0 before CR4. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Publicly provided connected documents confirm IBM...

CVE-2016-3001

IBM Connections Web UI is affected by an XSS vulnerability (CVE-2016-3001) in versions 4.x up to 4.5 CR5, 5.0 before CR4, and 5.5 before CR1. The issue is caused by injecting arbitrary script/HTML via an embedded string. Impact: remote authenticated users can execute script in the context of a us...

CVE-2016-0307

CVE-2016-0307 affects IBM Connections 5.5 and earlier. The vulnerability enables remote attackers to obtain sensitive information by reading stack traces that are exposed in returned responses, indicating an information-disclosure flaw likely tied to error handling. Affected software: IBM Connect...

CVE-2016-2956

CVE-2016-2956 is an XSS vulnerability in the IBM Connections Web UI affecting 5.0 before CR4 and 5.5 before CR1, exploitable by remote authenticated users via unspecified vectors. The available data does not specify the exact vulnerable component, exploit paths, successful impact beyond injected ...

CVE-2017-1682

The coordinated sources confirm a Cross-Site Scripting vulnerability in IBM Connections Web UI affecting IBM Connections versions 4.0, 4.5, 5.0, 5.5, and 6.0. The issue allows an attacker to embed arbitrary JavaScript in the Web UI, potentially altering functionality and leading to credentials di...

CVE-2016-2995

CVE-2016-2995 concerns a Cross-site scripting (XSS) vulnerability in the Web UI of IBM Connections. The flaw affects IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1. It allows remote authenticated users to inject arbitrary web script or HTML via unspecified ve...

CVE-2016-2998

CVE-2016-2998 describes a CSRF vulnerability in IBM Connections across multiple releases (4.0–CR4, 4.5–CR5, 5.0 before CR4, 5.5 before CR1). The underlying issue allows remote authenticated users to hijack the authentication of arbitrary users for requests that update data. Affected component is ...

CVE-2016-2999

CVE-2016-2999 affects IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1. The issue is described as an information disclosure via an unspecified brute-force attack accessible to remote authenticated users. The available documents do not provide concrete technical details abou...

CVE-2016-3004

CVE-2016-3004 describes a cross-site request forgery (CSRF) vulnerability in IBM Connections, affecting 4.0–CR4, 4.5–CR5, and 5.0 before CR4. The flaw allows a remote authenticated user to hijack the authentication of arbitrary users for requests that modify the set of available applications. The...

CVE-2016-0308

CVE-2016-0308 affects IBM Connections 5.5 and earlier. The vulnerability is a link manipulation issue that could cause display of inappropriate background images. According to NVD, this is a network-based issue with low attack complexity and no confidentiality/availability impact, but partial int...

CVE-2016-0322

CVE-2016-0322 affects IBM Connections; XSS arises in the HTML upload path. Impact is remote authenticated users can inject script/HTML by uploading an HTML document in IBM Connections 4.0–CR4, 4.5–CR5, 5.0–CR4, and 5.5 before CR1. Root cause described as HTML upload facilitating script execution....

CVE-2016-3008

CVE-2016-3008 is an XSS vulnerability in IBM Connections Web UI (5.0 before CR4, 5.5 before CR1) allowing remote authenticated users to inject arbitrary scripts via unspecified vectors. The connected sources do not provide explicit exploit details, patch versions, or confirmed in-the-wild exploit...

CVE-2015-5037

The CVE-2015-5037 entry concerns IBM Connections CSRF vulnerability. Affected are IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3. The issue allows a remote authenticated user to hijack the authentication of arbitrary users via requests that insert XSS s...

CVE-2016-3002

IBM Connections versions affected: 4.0–CR4, 4.5–CR5, and 5.0 before CR4. The issue is an information disclosure where physically proximate attackers can obtain sensitive data by reading cached data on a client device. Root cause is implied as caching of sensitive data accessible to local actors; ...

CVE-2015-7458

IBM Connections is affected by a cross-site scripting (XSS) vulnerability across multiple versions (3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4). The underlying cause is input validation failure that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Pub...

CVE-2016-2957

IBM Connections is affected on versions 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4. The vulnerability allows remote authenticated users to disclose sensitive information by reading a stack trace in a response. Root cause details are not fully specified in the provided documents, and no ...

CVE-2013-0569

CVE-2013-0569 describes an XSS vulnerability in the Communities component of IBM Connections 4.5 . Remote attackers can inject arbitrary web script or HTML via unspecified vectors. The available documents do not specify affected sub-components, exact vectors, exploit status, products beyond IBM C...