IBM
Page 51 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1378 | High | 7.8 | 2017-10-05 | IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) disclosed unencrypted login credentials to Vmware vCenter in the application trace output wh… |
CVE-2017-1339 | Medium | 4.4 | 2017-10-05 | IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) Server uses weak encryption for the password. A database administrator may be able to decryp… |
CVE-2017-1301 | Medium | 5.5 | 2017-10-05 | IBM Spectrum Protect 7.1 and 8.1 could allow a local attacker to launch a symlink attack. IBM Spectrum Protect Backup-archive Client creates temporary files in… |
CVE-2017-1201 | High | 7.8 | 2017-10-05 | IBM BigFix Compliance Analytics 1.9.79 (TEMA SUAv1 SCA SCM) stores user credentials in clear text which can be read by a local user. IBM X-Force ID: 123676. |
CVE-2016-8937 | Critical | 9.8 | 2017-10-05 | The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too m… |
CVE-2017-1541 | High | 7.3 | 2017-10-04 | A flaw in the AIX 5.3, 6.1, 7.1, and 7.2 JRE/SDK installp and updatep packages prevented the java.security, java.policy and javaws.policy files from being upda… |
CVE-2017-1126 | Medium | 5.3 | 2017-10-04 | IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that c… |
CVE-2017-1569 | High | 7.5 | 2017-10-03 | IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial of service. IBM X-Force ID: 131779. |
CVE-2017-1429 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1369 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1364 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1359 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1345 | Medium | 5.4 | 2017-10-03 | IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2017-1335 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1334 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1324 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1311 | High | 8.8 | 2017-10-03 | IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the att… |
CVE-2017-1591 | Medium | 6.1 | 2017-09-28 | IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1577 | High | 7.5 | 2017-09-28 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL… |
CVE-2017-1483 | High | 8.6 | 2017-09-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users a… |
CVE-2017-1407 | High | 8.8 | 2017-09-28 | IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending… |
CVE-2017-1539 | High | 8.8 | 2017-09-26 | IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user regist… |
CVE-2017-1531 | Medium | 5.4 | 2017-09-26 | IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2017-1530 | Medium | 5.4 | 2017-09-26 | IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2017-1527 | High | 8.1 | 2017-09-26 | IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could… |
CVE-2017-1425 | Medium | 5.4 | 2017-09-26 | IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2017-1555 | Medium | 4.3 | 2017-09-25 | IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed to the application plan. IBM X-Force ID… |
CVE-2017-1551 | Medium | 6.1 | 2017-09-25 | IBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious… |
CVE-2017-1424 | Medium | 5.4 | 2017-09-25 | IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2017-1362 | High | 7.8 | 2017-09-25 | IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 126801. |
CVE-2017-1346 | Low | 2.5 | 2017-09-25 | IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user withi… |
CVE-2017-1235 | Medium | 6.5 | 2017-09-25 | IBM WebSphere MQ 8.0 could allow an authenticated user to cause a premature termination of a client application thread which could potentially cause denial of… |
CVE-2015-0162 | High | 7.0 | 2017-09-20 | IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges. |
CVE-2014-6191 | Medium | 5.4 | 2017-09-19 | Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject arbitrary web scrip… |
CVE-2014-6106 | High | 8.8 | 2017-09-18 | Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of user… |
CVE-2015-0110 | Medium | 6.5 | 2017-09-15 | IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intend… |
CVE-2017-1490 | Medium | 5.3 | 2017-09-14 | An unspecified vulnerability in the Lifecycle Query Engine of Jazz Reporting Service 6.0 through 6.0.4 could disclose highly sensitive information. |
CVE-2017-1556 | Medium | 6.5 | 2017-09-13 | IBM API Connect 5.0.7.0 through 5.0.7.2 is vulnerable to a regular expression attack that could allow an authenticated attacker to use a regex and cause the sy… |
CVE-2017-1508 | Medium | 6.7 | 2017-09-13 | IBM Informix Dynamic Server 12.1 could allow a local user logged in with database administrator user to gain root privileges. IBM X-Force ID: 129620. |
CVE-2017-1520 | Low | 3.7 | 2017-09-12 | IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-F… |
CVE-2017-1519 | Medium | 5.9 | 2017-09-12 | IBM DB2 10.5 and 11.1 contains a denial of service vulnerability. A remote user can cause disruption of service for DB2 Connect Server setup with a particular… |
CVE-2017-1452 | High | 7.8 | 2017-09-12 | IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user to obtain elevated privilege and overwrite… |
CVE-2017-1451 | High | 7.8 | 2017-09-12 | IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance owner privileges to obta… |
CVE-2017-1439 | Medium | 6.7 | 2017-09-12 | IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance owner privileges to obta… |
CVE-2017-1438 | Medium | 6.7 | 2017-09-12 | IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user with DB2 instance owner privileges to obta… |
CVE-2017-1434 | Medium | 4.7 | 2017-09-12 | IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) under unusual circumstances, could expose highly sensitive information in the error log… |
CVE-2017-1352 | Medium | 5.5 | 2017-09-12 | IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downl… |
CVE-2017-1162 | High | 7.5 | 2017-09-12 | IBM QRadar 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force I… |
CVE-2014-9565 | High | 8.8 | 2017-09-07 | Cross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware 3.4.0000 and earlier. |
CVE-2017-1502 | Medium | 5.4 | 2017-09-07 | IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1189 | Medium | 6.1 | 2017-09-07 | IBM WebSphere Portal and Web Content Manager 6.1, 7.0, and 8.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc… |
CVE-2017-1098 | Medium | 5.4 | 2017-09-07 | IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2017-1491 | High | 7.5 | 2017-09-05 | IBM QRadar Network Security 5.4 supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protectio… |
CVE-2017-1458 | High | 8.1 | 2017-09-05 | IBM QRadar Network Security 5.4 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vu… |
CVE-2017-1457 | Medium | 6.1 | 2017-09-05 | IBM QRadar Network Security 5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2017-1130 | Medium | 6.5 | 2017-09-05 | IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it would open up many file select dialog boxes… |
CVE-2017-1129 | Medium | 6.5 | 2017-09-05 | IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it could cause the Notes client to hang and ha… |
CVE-2017-1097 | High | 8.8 | 2017-09-05 | IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site request forgery which could allow an attacker to execut… |
CVE-2017-1450 | Medium | 6.1 | 2017-08-31 | IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a… |
CVE-2017-1449 | Medium | 5.4 | 2017-08-31 | IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a… |
CVE-2017-1447 | Medium | 5.4 | 2017-08-31 | IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2017-1444 | Medium | 5.4 | 2017-08-31 | IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2017-1446 | Medium | 5.4 | 2017-08-30 | IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2017-1445 | Medium | 5.4 | 2017-08-30 | IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2017-1443 | Medium | 6.1 | 2017-08-30 | IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2017-1442 | High | 8.8 | 2017-08-30 | IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized acti… |
CVE-2017-1441 | Medium | 5.5 | 2017-08-30 | IBM Emptoris Services Procurement 10.0.0.5 could allow a local user to view sensitive information stored locally due to improper access control. IBM X-Force ID… |
CVE-2017-1440 | High | 8.8 | 2017-08-30 | IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to sp… |
CVE-2017-1535 | Medium | 5.4 | 2017-08-29 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2017-1485 | Medium | 5.4 | 2017-08-29 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2017-1428 | Medium | 6.1 | 2017-08-29 | IBM Cognos Analytics 11.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a re… |
CVE-2017-1427 | Medium | 6.1 | 2017-08-29 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2017-1195 | Medium | 6.1 | 2017-08-29 | IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuad… |
CVE-2016-2980 | Medium | 6.3 | 2017-08-29 | The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in th… |
CVE-2016-2978 | Low | 3.3 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 could store potentially sensitive information from the browser cache locally that could be available to a local user. IBM X-Force ID… |
CVE-2016-2976 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the meeting report histor… |
CVE-2016-2975 | Medium | 5.4 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2016-2974 | Low | 3.3 | 2017-08-29 | IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to the Sametime envir… |
CVE-2016-2967 | Medium | 5.4 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Sametime away messa… |
CVE-2016-2966 | Medium | 4.3 | 2017-08-29 | IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113847. |
CVE-2016-2964 | Medium | 5.3 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about the application. IBM… |
CVE-2016-0358 | Medium | 4.3 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 could allow an unauthorized authenticated user to enumerate group chat ID numbers and join meetings that he was not invited to. IBM… |
CVE-2016-2979 | Medium | 5.4 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2016-2977 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a malicious user to lower other users hands in the meeting. IBM X-Force ID: 113937. |
CVE-2016-2973 | Medium | 5.4 | 2017-08-29 | IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2016-2972 | High | 7.8 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which could be accessed by… |
CVE-2016-2971 | Medium | 5.3 | 2017-08-29 | IBM Sametime Media Services 8.5.2 and 9.0 can disclose sensitive information in stack trace error logs that could aid an attacker in future attacks. IBM X-Forc… |
CVE-2016-2969 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages. IBM X-Force ID: 113850. |
CVE-2016-2965 | Medium | 6.5 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a us… |
CVE-2016-2959 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting room manager to remove the primary managers privileges. IBM X-Force ID: 113804. |
CVE-2016-10503 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could allow an authenticated and invited user of Sametime meeting to lower any or all hands in an e-meeting, thus spo… |
CVE-2016-0356 | Medium | 6.5 | 2017-08-29 | IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sh… |
CVE-2016-0355 | Medium | 6.5 | 2017-08-29 | IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sh… |
CVE-2016-0354 | Medium | 5.5 | 2017-08-29 | IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be dow… |
CVE-2017-1489 | Medium | 6.1 | 2017-08-29 | IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redi… |
CVE-2017-1376 | Critical | 9.8 | 2017-08-29 | A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873. |
CVE-2017-1110 | Medium | 6.5 | 2017-08-29 | IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to view the incidents o… |
CVE-2016-9732 | Medium | 5.4 | 2017-08-29 | IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2016-2970 | Medium | 4.3 | 2017-08-29 | IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application to possible attack… |
CVE-2015-0114 | High | 7.8 | 2017-08-28 | Stack-based buffer overflow in IBM V5R4, and IBM i Access for Windows 6.1 and 7.1. |