CVE-2014-6271

CVE-2014-6271 (Shellshock) affects GNU Bash up to 4.3, enabling remote code execution by processing trailing strings after function definitions in environment variables. Exploitation vectors include OpenSSH ForceCommand, mod_cgi/mod_cgid in Apache, DHCP client scripts, and other environment-passi...

CVE-2014-7169

CVE-2014-7169 affects GNU Bash up to 4.3, where parsing of function definitions in environment variables can be exploited to run commands or impact other attributes across privilege boundaries (notably via ForceCommand in OpenSSH sshd and via mod_cgi/mod_cgid in Apache, as well as DHCP client scr...

CVE-2014-6079

CVE-2014-6079 is an XSS vulnerability in IBM Security Access Manager for Web Local Management Interface affecting IBM Security Access Manager for Web 7.x (before 7.0.0-ISS-WGA-IF0009) and 8.x (before 8.0.0-ISS-WGA-FP0005), and Security Access Manager for Mobile 8.x (before 8.0.0-ISS-ISAM-FP0005)....

CVE-2016-3016

CVE-2016-3016 affects IBM Security Access Manager for Web (and related appliances) where code origin/integrity is not sufficiently verified before processing patches, backups or updates. This could allow an authenticated attacker to load malicious code. Affected products include IBM Security Acce...

CVE-2016-3022

CVE-2016-3022 affects IBM Security Access Manager for Web. An authenticated user could gain access to highly sensitive information due to incorrect file permissions. According to IBM’s bulletin, affected appliances include Web 7.0, 8.0, 9.0 family (and Web/Mobile variants), with all firmware vers...

CVE-2016-3017

CVE-2016-3017 affects IBM Security Access Manager (ISAM) products. The root cause is security misconfigurations that could allow a remote attacker to obtain sensitive information. Affected are IBM Security Access Manager for Web 7.0 appliances (7.0.0), 8.0 appliances (all firmware versions), IBM ...

CVE-2016-3029

CVE-2016-3029 affects IBM Security Access Manager products. IBM Security Access Manager for Web appliances (8.0.x, upgrade path to 8.0.1.5), Mobile 8.0.x, and IAM 9.0 appliances are vulnerable to cross-site request forgery, allowing unauthorized actions from a trusted user. Remediation requires a...

CVE-2016-3024

CVE-2016-3024 affects IBM Security Access Manager family. IBM’s bulletin and IBM/ISAM pages confirm a local information-disclosure vulnerability where web pages containing sensitive info could be cached by the browser and read by another user on the same system. Affected products include IBM Secu...

CVE-2016-2908

CVE-2016-2908 is a XML External Entity (XXE) vulnerability affecting IBM Security products. IBM security advisories and IBM/Tivoli bulletins show that the flaw arises from XML parsing in affected components, enabling a remote attacker to read arbitrary files or cause a denial of service. Affected...

CVE-2014-4823

CVE-2014-4823 affects IBM Security Access Manager for Web 7.x (before 7.0.0-ISS-WGA-IF0009) and 8.x (before 8.0.0-ISS-WGA-FP0005), plus Security Access Manager for Mobile 8.x (before 8.0.0-ISS-ISAM-FP0005). The administration console allows remote attackers to inject system commands via unspecifi...

CVE-2016-3021

CVE-2016-3021 affects IBM Security Access Manager for Web and related appliances. An authenticated attacker could cause an error message to reveal sensitive environment data via a specially crafted HTTP request. The IBM bulletin lists affected products/versions: Web 7.0 appliances, Web 8.0.x, Web...

CVE-2016-3023

CVE-2016-3023 affects IBM Security Access Manager for Web and related appliances. An unauthenticated user could gain access to sensitive information by entering invalid file names. Affected: Web 7.0 appliances, Web 8.0 appliances, Mobile 8.0 appliances, and ISAM 9.0 appliances (all firmware versi...

CVE-2016-3027

CVE-2016-3027 affects IBM Security Access Manager products. The IBM Security Access Manager for Web (8.0 appliances, all firmware), Security Access Manager for Mobile (8.0), and Security Access Manager (9.0) are vulnerable to a denial of service due to an XML External Entity (XXE) issue when proc...