CVE-2017-1199

IBM InfoSphere Master Data Management Server is affected by CVE-2017-1199 (XSS in the Web UI) affecting versions 10.1, 11.0, 11.3, 11.4, 11.5, and 11.6. The vulnerability allows embedding arbitrary JavaScript in the UI, potentially leading to credentials disclosure within a trusted session. IBM’s...

CVE-2016-9716

CVE-2016-9716 affects IBM InfoSphere Master Data Management Server versions 11.0, 11.3, 11.4, 11.5, and 11.6. The issue is a cross-site request forgery (CSRF) vulnerability that could allow an attacker to perform malicious, unauthorized actions on behalf of a trusted user. The IBM security bullet...

CVE-2016-9717

CVE-2016-9717 affects IBM InfoSphere Master Data Management Server versions 10.1, 11.0, 11.3, 11.4, 11.5, and 11.6. Described as an HTTP Parameter Override that reveals duplicated parameters, potentially causing anomalous application behavior that can be exploited. IBM’s Security Bulletin provide...

CVE-2017-1309

IBM InfoSphere Master Data Management Reference Data Management Hub (and related Server components) versions 11.0–11.6 store user credentials in plaintext, enabling local read by an attacker. The IBM security bulletin confirms the root cause is credentials stored in clear text and lists affected ...

CVE-2015-1910

CVE-2015-1910 is an XSS vulnerability in IBM InfoSphere MDM Reference Data Management. The flaw affects IBM InfoSphere MDM Reference Data Management on the server side in versions 10.1 (before IF1), 11.0 (before FP3), and 11.3, allowing remote authenticated users to inject arbitrary script via a ...

CVE-2015-1945

IBM InfoSphere Master Data Management Reference Data Management component is affected by CVE-2015-1945. An authenticated attacker can escalate privileges due to an improper authorization check, impacting IBM InfoSphere Reference Data Management versions 10.1, 11.0, 11.3 before FP3, and 11.4. Reme...

CVE-2016-9718

IBM InfoSphere Master Data Management Server (versions 10.1, 11.0, 11.3, 11.4, 11.5, 11.6) is vulnerable to cross-site scripting in the Web UI, enabling a user to inject arbitrary JavaScript and potentially disclose credentials. The IBM bulletin identifies insecure HTTP TRACE method as discovered...

CVE-2020-4675

CVE-2020-4675 affects IBM InfoSphere Master Data Management Server (11.6). The root issue is a CSRF vulnerability in the web application where referer-header validation relies on an allowlist and can be bypassed by attacker-controlled subdomains, enabling CSRF to trigger malicious actions without...

CVE-2015-1909

IBM InfoSphere MDM Reference Data Management is vulnerable to an XML External Entity (XXE) attack due to a weakly configured XML parser. Affected are the Reference Data Management server components for versions: 10.1 before IF1, 11.0 before FP3, 11.3, and 11.4 before FP2. Exploitation could allow...

CVE-2016-9715

IBM InfoSphere Master Data Management Server versions 11.0, 11.3, 11.4, 11.5, and 11.6 are affected by CVE-2016-9715, a cross-site scripting vulnerability in the Web UI that could allow an attacker to inject arbitrary JavaScript and potentially disclose credentials within a trusted session. The i...

CVE-2014-0873

IBM InfoSphere Master Data Management Server is affected by CSRF in the Data Stewardship, Business Admin, and Product interfaces. The issue allows an attacker to hijack a legitimate user’s session by exploiting insufficient CSRF protections. Affected versions: 8.5 before 8.5.0.82; 9.0.1 before 9....

CVE-2016-9714

CVE-2016-9714 affects IBM InfoSphere Master Data Management Server versions 10.1, 11.0, 11.3, 11.4, 11.5 and 11.6. IBM’s bulletin identifies an insecure JSF ViewState in the MDM UI (Business Admin) that enables cross-site request forgery, allowing an attacker to perform unauthorized actions. The ...

CVE-2016-9719

CVE-2016-9719 affects IBM InfoSphere Master Data Management Server (versions 10.1, 11.0, 11.3, 11.4, 11.5, 11.6). Root cause: missing/ineffective X-Frame-Options header enabling clickjacking; remote attacker could entice a user to a malicious site to hijack click actions and potentially facilitat...