IBM Corporation
Page 3 of 3 — IBM Corporation CVEs from a corpus of 288, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-8966 | Medium | 5.9 | 2017-02-01 | IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security… |
CVE-2016-8961 | Medium | 6.1 | 2017-02-01 | IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-c… |
CVE-2016-8943 | Medium | 5.4 | 2017-02-01 | IBM Tivoli Storage Productivity Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2016-8942 | Low | 3.1 | 2017-02-01 | IBM Tivoli Storage Productivity Center could allow an authenticated user with intimate knowledge of the system to edit a limited set of properties on the serve… |
CVE-2016-8941 | High | 8.8 | 2017-02-01 | IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2016-8936 | Medium | 6.1 | 2017-02-01 | IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2016-8934 | Medium | 5.4 | 2017-02-01 | IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-8922 | Medium | 6.1 | 2017-02-01 | Exphox WebRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the inten… |
CVE-2016-8921 | High | 8.8 | 2017-02-01 | IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable se… |
CVE-2016-8920 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2016-8918 | Medium | 5.9 | 2017-02-01 | IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials. |
CVE-2016-8913 | Medium | 6.5 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted… |
CVE-2016-8912 | Medium | 4.3 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user. |
CVE-2016-8911 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mal… |
CVE-2016-6126 | Medium | 6.5 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted… |
CVE-2016-6125 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2016-6124 | High | 8.8 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary cod… |
CVE-2016-6123 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2016-6122 | Medium | 4.3 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 discloses answers to security questions in a response to authenticated users. |
CVE-2016-6113 | Medium | 6.1 | 2017-02-01 | IBM Verse is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended fu… |
CVE-2016-6090 | Critical | 9.8 | 2017-02-01 | IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized administrative opera… |
CVE-2016-6085 | Medium | 6.5 | 2017-02-01 | IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers. |
CVE-2016-6084 | Medium | 6.5 | 2017-02-01 | IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema request. |
CVE-2016-6082 | Critical | 10.0 | 2017-02-01 | IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit… |
CVE-2016-6080 | Medium | 5.3 | 2017-02-01 | The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker. |
CVE-2016-6072 | Medium | 5.4 | 2017-02-01 | IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2016-6065 | High | 7.8 | 2017-02-01 | IBM Security Guardium Database Activity Monitor appliance could allow a local user to inject commands that would be executed as root. |
CVE-2016-6061 | Medium | 5.4 | 2017-02-01 | IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the i… |
CVE-2016-6059 | High | 8.1 | 2017-02-01 | IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remo… |
CVE-2016-6054 | Medium | 5.4 | 2017-02-01 | IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the i… |
CVE-2016-6047 | Medium | 5.4 | 2017-02-01 | IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-6046 | Medium | 5.4 | 2017-02-01 | IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2016-6045 | High | 8.8 | 2017-02-01 | IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2016-6044 | Medium | 4.3 | 2017-02-01 | IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker… |
CVE-2016-6043 | High | 7.0 | 2017-02-01 | Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced. |
CVE-2016-6042 | High | 7.3 | 2017-02-01 | IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory. By pers… |
CVE-2016-6040 | Medium | 5.0 | 2017-02-01 | IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced. |
CVE-2016-6039 | Medium | 5.4 | 2017-02-01 | IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-6034 | Medium | 6.8 | 2017-02-01 | IBM Tivoli Storage Manager for Virtual Environments (VMware) could disclose the Windows domain credentials to a user with a high level of privileges. |
CVE-2016-6030 | Medium | 5.4 | 2017-02-01 | IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the i… |
CVE-2016-6028 | Medium | 4.3 | 2017-02-01 | IBM Jazz technology based products might allow an attacker to view work item titles that they do not have privilege to view. |
CVE-2016-6020 | Medium | 6.1 | 2017-02-01 | IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim t… |
CVE-2016-6000 | Medium | 6.1 | 2017-02-01 | IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5994 | Medium | 6.5 | 2017-02-01 | IBM InfoSphere Information Server contains a vulnerability that would allow an authenticated user to browse any file on the engine tier, and examine its conten… |
CVE-2016-5990 | Medium | 6.3 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automatically executed by the s… |
CVE-2016-5988 | Medium | 6.5 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance could disclose sensitive information in generated error messages that would be available to an authe… |
CVE-2016-5985 | High | 7.8 | 2017-02-01 | The IBM Tivoli Storage Manager (IBM Spectrum Protect) AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. A local attacker coul… |
CVE-2016-5984 | Medium | 6.1 | 2017-02-01 | IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this v… |
CVE-2016-5980 | Medium | 5.4 | 2017-02-01 | IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5966 | Medium | 5.9 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly ena… |
CVE-2016-5964 | Critical | 9.8 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remote attacker to brute… |
CVE-2016-5958 | High | 7.5 | 2017-02-01 | IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the se… |
CVE-2016-5952 | High | 8.8 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker… |
CVE-2016-5951 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5950 | Medium | 6.5 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read by an authenticated user. |
CVE-2016-5949 | Medium | 4.3 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request. |
CVE-2016-5948 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5939 | Medium | 6.3 | 2017-02-01 | IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view… |
CVE-2016-5937 | High | 8.8 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transm… |
CVE-2016-5899 | Medium | 5.4 | 2017-02-01 | IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5898 | Medium | 4.3 | 2017-02-01 | IBM Jazz Reporting Service (JRS) could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a dire… |
CVE-2016-5897 | Medium | 5.4 | 2017-02-01 | IBM Jazz Reporting Service (JRS) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in t… |
CVE-2016-5896 | Medium | 5.3 | 2017-02-01 | IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser. |
CVE-2016-5882 | Medium | 6.1 | 2017-02-01 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f… |
CVE-2016-5880 | Medium | 5.4 | 2017-02-01 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f… |
CVE-2016-3053 | High | 7.8 | 2017-02-01 | IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. |
CVE-2016-3046 | Low | 2.7 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements which could allow the attacke… |
CVE-2016-3045 | Low | 3.7 | 2017-02-01 | IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access… |
CVE-2016-3043 | Medium | 5.9 | 2017-02-01 | IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2016-3035 | Medium | 5.3 | 2017-02-01 | IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server. |
CVE-2016-3034 | Medium | 4.4 | 2017-02-01 | IBM AppScan Source uses a one-way hash without salt to encrypt highly sensitive information, which could allow a local attacker to decrypt information more eas… |
CVE-2016-3029 | High | 8.8 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tra… |
CVE-2016-3027 | Medium | 6.5 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A re… |
CVE-2016-3024 | Medium | 4.0 | 2017-02-01 | IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-3023 | Medium | 5.3 | 2017-02-01 | IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file names. |
CVE-2016-3022 | Medium | 6.5 | 2017-02-01 | IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions. |
CVE-2016-3021 | Low | 2.7 | 2017-02-01 | IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP req… |
CVE-2016-3018 | Medium | 6.1 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2016-3017 | High | 7.5 | 2017-02-01 | IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations. |
CVE-2016-3016 | Medium | 4.4 | 2017-02-01 | IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, whi… |
CVE-2016-2987 | Medium | 4.3 | 2017-02-01 | An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker. |
CVE-2016-2939 | Medium | 6.1 | 2017-02-01 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f… |
CVE-2016-2908 | Critical | 9.1 | 2017-02-01 | IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML d… |
CVE-2016-0396 | High | 8.1 | 2017-02-01 | IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than ex… |
CVE-2016-0394 | Low | 3.3 | 2017-02-01 | IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files. |
CVE-2016-0297 | Low | 3.7 | 2017-02-01 | IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transpo… |
CVE-2016-0296 | Low | 3.3 | 2017-02-01 | IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user. |
CVE-2016-0265 | Medium | 5.4 | 2017-02-01 | IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability us… |