IBM Corporation
Page 2 of 3 — IBM Corporation CVEs from a corpus of 288, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9009 | Low | 3.1 | 2017-02-24 | IBM WebSphere MQ 8.0 could allow an authenticated user with authority to create a cluster object to cause a denial of service to MQ clustering. IBM Reference #… |
CVE-2016-8998 | High | 7.2 | 2017-02-24 | IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted… |
CVE-2016-8974 | High | 8.1 | 2017-02-23 | IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remot… |
CVE-2016-6055 | Medium | 5.4 | 2017-02-23 | IBM Rational DOORS Next Generation 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2016-5883 | Medium | 6.1 | 2017-02-23 | IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2016-8986 | Medium | 6.5 | 2017-02-22 | IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager to bring down MQ channels using specially crafted HTTP requests. IBM Re… |
CVE-2016-8915 | Medium | 6.5 | 2017-02-22 | IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager and queue, to deny service to other channels running under the same pro… |
CVE-2016-3052 | Medium | 5.9 | 2017-02-22 | Under non-standard configurations, IBM WebSphere MQ might send password data in clear text over the network. This data could be intercepted using man in the mi… |
CVE-2016-3013 | Medium | 6.5 | 2017-02-22 | IBM WebSphere MQ 8.0 could allow an authenticated user to crash the MQ channel due to improper data conversion handling. IBM Reference #: 1998661. |
CVE-2016-6062 | Medium | 6.1 | 2017-02-16 | IBM Resilient v26.0, v26.1, and v26.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t… |
CVE-2016-5919 | High | 7.5 | 2017-02-16 | IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly s… |
CVE-2016-9706 | Critical | 9.1 | 2017-02-15 | IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE)… |
CVE-2016-9010 | Medium | 6.1 | 2017-02-15 | IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a maliciou… |
CVE-2016-8972 | High | 7.8 | 2017-02-15 | IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the bellmail client. IBM APARs: IV91006, IV… |
CVE-2016-8968 | Medium | 5.4 | 2017-02-15 | IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the i… |
CVE-2016-8944 | Medium | 5.5 | 2017-02-15 | IBM AIX 7.1 and 7.2 allows a local user to open a file with a specially crafted argument that would crash the system. IBM APARs: IV91488, IV91487, IV91456, IV9… |
CVE-2016-6079 | High | 7.8 | 2017-02-15 | IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM APARs… |
CVE-2016-6077 | Medium | 5.3 | 2017-02-15 | IBM Cognos Disclosure Management 10.2 could allow a malicious attacker to execute commands as a lower privileged user that opens a malicious document. IBM Refe… |
CVE-2016-6060 | Medium | 4.3 | 2017-02-15 | An undisclosed vulnerability in IBM Rational DOORS Next Generation 4.0, 5.0, and 6.0 could allow a JazzGuest user to see project names. IBM Reference #: 199554… |
CVE-2016-6033 | High | 8.8 | 2017-02-15 | IBM Tivoli Storage Manager for Virtual Environments 7.1 (VMware) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious… |
CVE-2016-0360 | Critical | 9.8 | 2017-02-15 | IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow a malicious user t… |
CVE-2017-1121 | Medium | 5.4 | 2017-02-13 | IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2016-9005 | Critical | 9.8 | 2017-02-08 | IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remo… |
CVE-2016-8954 | Critical | 9.8 | 2017-02-08 | IBM dashDB Local uses hard-coded credentials that could allow a remote attacker to gain access to the Docker container or database. |
CVE-2016-5934 | High | 7.3 | 2017-02-08 | IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the… |
CVE-2016-5918 | Medium | 4.7 | 2017-02-08 | IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is… |
CVE-2016-5902 | Medium | 6.1 | 2017-02-08 | IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2016-5900 | Medium | 5.9 | 2017-02-08 | IBM Tealeaf Customer Experience on Cloud Network Capture Add-On could allow a remote attacker to obtain sensitive information, caused by the failure to properl… |
CVE-2016-0310 | Medium | 5.4 | 2017-02-08 | IBM Connections 5.5 and earlier is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. |
CVE-2016-0308 | Medium | 4.3 | 2017-02-08 | IBM Connections 5.5 and earlier is vulnerable to possible link manipulation attack that could result in the display of inappropriate background images. |
CVE-2016-0307 | Medium | 4.3 | 2017-02-08 | IBM Connections 5.5 and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned responses. |
CVE-2016-0305 | Medium | 5.4 | 2017-02-08 | IBM Connections is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability… |
CVE-2016-0214 | High | 7.8 | 2017-02-08 | IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious f… |
CVE-2016-0210 | Medium | 5.3 | 2017-02-08 | IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to obtain sensitive information. By allowing HTTP OPTIONS method, a remote attacker… |
CVE-2016-0206 | Low | 3.3 | 2017-02-08 | IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a specially crafted and… |
CVE-2016-0203 | Medium | 5.5 | 2017-02-08 | A vulnerability has been identified in the IBM Cloud Orchestrator task API. The task API might allow an authenticated user to view background information assoc… |
CVE-2016-0202 | Low | 3.3 | 2017-02-08 | A vulnerability has been identified in tasks, backend object generated for handling any action performed by the application in IBM Cloud Orchestrator. It is po… |
CVE-2015-7494 | Low | 2.8 | 2017-02-08 | A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resour… |
CVE-2015-7493 | Medium | 4.7 | 2017-02-08 | IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sens… |
CVE-2015-7418 | Medium | 4.4 | 2017-02-08 | IBM WebSphere eXtreme Scale and the WebSphere DataPower XC10 Appliance allow some sensitive data to linger in memory instead of being overwritten which could a… |
CVE-2015-1976 | Medium | 5.5 | 2017-02-08 | IBM Security Directory Server could allow an authenticated user to execute commands into the web administration tool that would cause the tool to crash. |
CVE-2017-1128 | Medium | 5.4 | 2017-02-08 | IBM Rational DOORS Next Generation 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1127 | Medium | 5.4 | 2017-02-08 | IBM Rational DOORS Next Generation 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2016-9748 | Medium | 4.3 | 2017-02-08 | IBM Rational DOORS Next Generation 5.0 and 6.0 discloses sensitive information in error response messages that could be used for further attacks against the sy… |
CVE-2016-6032 | Medium | 5.4 | 2017-02-08 | IBM Rational Team Concert 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2016-2866 | Medium | 4.3 | 2017-02-08 | An unspecified vulnerability in IBM Jazz Team Server may disclose some deployment information to an authenticated user. |
CVE-2015-5013 | Medium | 5.5 | 2017-02-08 | The IBM Security Access Manager appliance includes configuration files that contain obfuscated plaintext-passwords which authenticated users can access. |
CVE-2016-6104 | High | 7.2 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, wh… |
CVE-2016-6097 | Medium | 4.0 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-6096 | Medium | 6.1 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2016-6094 | Medium | 4.3 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or associated… |
CVE-2016-6092 | Medium | 6.2 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user. |
CVE-2016-3020 | Medium | 5.5 | 2017-02-07 | IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictions, caused by improper content validatio… |
CVE-2017-1093 | High | 7.8 | 2017-02-02 | IBM AIX 6.1, 7.1, and 7.2 could allow a local user to exploit a vulnerability in the bellmail binary to gain root privileges. |
CVE-2016-6116 | Medium | 5.9 | 2017-02-02 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Stric… |
CVE-2016-6103 | High | 8.8 | 2017-02-02 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2016-6099 | Medium | 5.3 | 2017-02-02 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the… |
CVE-2016-6095 | Critical | 9.8 | 2017-02-02 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. |
CVE-2016-5935 | Medium | 5.9 | 2017-02-02 | IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate… |
CVE-2016-9739 | High | 7.8 | 2017-02-01 | IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user. |
CVE-2016-9704 | Medium | 6.1 | 2017-02-01 | IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2016-9703 | Low | 2.4 | 2017-02-01 | IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work stat… |
CVE-2016-9008 | High | 7.5 | 2017-02-01 | IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent. |
CVE-2016-9000 | Medium | 6.1 | 2017-02-01 | IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerabil… |
CVE-2016-8999 | Medium | 5.4 | 2017-02-01 | IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facili… |
CVE-2016-8982 | Medium | 5.3 | 2017-02-01 | IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access t… |
CVE-2016-8977 | Medium | 5.3 | 2017-02-01 | IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further a… |
CVE-2016-8963 | Medium | 5.5 | 2017-02-01 | IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2016-8938 | Critical | 10.0 | 2017-02-01 | IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be execute… |
CVE-2016-8933 | Medium | 6.5 | 2017-02-01 | IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing… |
CVE-2016-8932 | High | 8.8 | 2017-02-01 | IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable ser… |
CVE-2016-8931 | High | 8.8 | 2017-02-01 | IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable ser… |
CVE-2016-8930 | High | 7.6 | 2017-02-01 | IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view… |
CVE-2016-8929 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view… |
CVE-2016-8928 | High | 7.6 | 2017-02-01 | IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view… |
CVE-2016-8919 | High | 7.5 | 2017-02-01 | IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the co… |
CVE-2016-6115 | High | 7.2 | 2017-02-01 | IBM General Parallel File System is vulnerable to a buffer overflow. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the… |
CVE-2016-6110 | Medium | 6.5 | 2017-02-01 | IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user. |
CVE-2016-6068 | High | 7.5 | 2017-02-01 | IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties. |
CVE-2016-6001 | Low | 3.1 | 2017-02-01 | IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing for some information d… |
CVE-2016-5953 | Low | 3.7 | 2017-02-01 | IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permission… |
CVE-2016-5942 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t… |
CVE-2016-5941 | Medium | 5.7 | 2017-02-01 | IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing… |
CVE-2016-5940 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t… |
CVE-2016-5938 | Low | 3.3 | 2017-02-01 | IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-5881 | Medium | 6.1 | 2017-02-01 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f… |
CVE-2016-2992 | Medium | 5.4 | 2017-02-01 | IBM Infosphere BigInsights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2016-2942 | High | 7.5 | 2017-02-01 | IBM UrbanCode Deploy could allow an authenticated attacker with special permissions to craft a script on the server in a way that will cause processes to run o… |
CVE-2016-2941 | Medium | 5.5 | 2017-02-01 | IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could be read by a local u… |
CVE-2016-2924 | Medium | 5.4 | 2017-02-01 | IBM Infosphere BigInsights is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vu… |
CVE-2016-0320 | Medium | 4.3 | 2017-02-01 | IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users editing UCD objects… |
CVE-2016-0218 | Medium | 5.4 | 2017-02-01 | IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remo… |
CVE-2016-0217 | Medium | 5.4 | 2017-02-01 | IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input… |
CVE-2016-8967 | Medium | 5.5 | 2017-02-01 | IBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a local user. |
CVE-2016-6117 | Medium | 5.3 | 2017-02-01 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 can be deployed with active debugging code that can disclose sensitive information. |
CVE-2016-6105 | High | 8.2 | 2017-02-01 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonymous users access to… |
CVE-2016-0371 | Medium | 5.5 | 2017-02-01 | The Tivoli Storage Manager (TSM) password may be displayed in plain text via application trace output while application tracing is enabled. |
CVE-2016-9731 | Medium | 5.4 | 2017-02-01 | IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2016-8981 | Medium | 5.5 | 2017-02-01 | IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-8980 | High | 8.1 | 2017-02-01 | IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacke… |