IBM
Page 52 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-0101 | Medium | 6.1 | 2017-08-28 | Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business Proces… |
CVE-2014-8900 | High | 8.8 | 2017-08-28 | Cross-site request forgery (CSRF) vulnerability in IBM UrbanCode Release 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier. |
CVE-2014-9564 | Medium | 6.1 | 2017-08-25 | CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inje… |
CVE-2017-1422 | Low | 3.3 | 2017-08-22 | IBM MaaS360 DTM all versions up to 3.81 does not perform proper verification for user rights of certain applications which could disclose sensitive information… |
CVE-2014-6189 | Medium | 6.1 | 2017-08-22 | Cross-site scripting (XSS) vulnerability in IBM Security Network Protection 3100, 4100, 5100, and 7100 devices with firmware 5.2 before 5.2.0.0-ISS-XGS-All-Mod… |
CVE-2017-1501 | Medium | 5.9 | 2017-08-18 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 could provide weaker than expected security after using the Admin Console to update the web services securit… |
CVE-2017-1338 | Medium | 5.4 | 2017-08-18 | IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1469 | High | 7.8 | 2017-08-14 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in installation directori… |
CVE-2017-1190 | Medium | 6.4 | 2017-08-14 | IBM Emptoris Strategic Supply Management Platform 10.x and 10.1 could allow a local user with special access roles to execute arbitrary code on the system. By… |
CVE-2016-6029 | Medium | 5.9 | 2017-08-14 | IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properl… |
CVE-2016-6021 | Medium | 5.4 | 2017-08-14 | IBM Emptoris Strategic Supply Management Platform 10.0 and 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaS… |
CVE-2017-1431 | Medium | 5.4 | 2017-08-10 | IBM InfoSphere Streams 4.0, 4.1, and 4.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2017-1377 | Medium | 4.3 | 2017-08-10 | IBM Runbook Automation reveals sensitive information in error messages that could be used in further attacks against the system. IBM X-Force ID: 126874. |
CVE-2017-1192 | High | 8.2 | 2017-08-10 | IBM Sterling B2B Integrator 5.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this v… |
CVE-2017-1174 | High | 8.8 | 2017-08-10 | IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could all… |
CVE-2017-1168 | Medium | 5.4 | 2017-08-10 | IBM Rational Engineering Lifecycle Manager 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri… |
CVE-2017-3752 | High | 8.2 | 2017-08-09 | An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches… |
CVE-2017-1448 | Medium | 5.4 | 2017-08-09 | IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persu… |
CVE-2017-1357 | Medium | 4.3 | 2017-08-09 | IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further adva… |
CVE-2016-8949 | Medium | 5.4 | 2017-08-09 | IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persu… |
CVE-2016-6121 | Medium | 5.4 | 2017-08-09 | IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri… |
CVE-2017-1331 | Medium | 5.4 | 2017-08-04 | IBM Content Navigator 2.0.3 and 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t… |
CVE-2017-1504 | Medium | 6.5 | 2017-08-03 | IBM WebSphere Application Server version 9.0.0.4 could provide weaker than expected security after using the PasswordUtil command to enable AES password encryp… |
CVE-2017-1327 | Medium | 6.1 | 2017-08-03 | IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2017-1199 | Medium | 5.4 | 2017-08-03 | IBM InfoSphere Master Data Management Server 10.0, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to e… |
CVE-2015-0194 | Medium | 6.5 | 2017-08-02 | XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read ar… |
CVE-2014-8903 | High | 8.8 | 2017-08-02 | IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrar… |
CVE-2017-1495 | Medium | 4.9 | 2017-08-02 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a privileged user to cause a memory dump that could contain highly sensitive information incl… |
CVE-2017-1468 | High | 7.8 | 2017-08-02 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in installation directori… |
CVE-2017-1467 | High | 8.1 | 2017-08-02 | A network layer security vulnerability in InfoSphere Information Server 9.1, 11.3, and 11.5 can lead to privilege escalation or unauthorized access. IBM X-Forc… |
CVE-2017-1383 | Critical | 9.1 | 2017-08-02 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2017-1118 | High | 7.5 | 2017-08-02 | IBM WebSphere MQ Internet Pass-Thru 2.0 and 2.1 could allow n attacker to cause the MQIPT to stop responding due to an incorrectly configured security policy… |
CVE-2016-9981 | High | 8.1 | 2017-08-02 | IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 120257 |
CVE-2017-1500 | Medium | 6.1 | 2017-08-01 | A Reflected Cross Site Scripting (XSS) vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1, 6.2, 6.3… |
CVE-2017-1496 | Medium | 5.4 | 2017-07-31 | IBM Sterling B2B Integrator Standard Edition 5.2.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2017-1460 | High | 7.5 | 2017-07-31 | IBM i OSPF 6.1, 7.1, 7.2, and 7.3 is vulnerable when a rogue router spoofs its origin. Routing tables are affected by a missing LSA, which may lead to loss of… |
CVE-2017-1386 | Medium | 5.9 | 2017-07-31 | IBM API Connect 5.0.0.0 could allow a user to bypass policy restrictions and create non-compliant passwords which could be intercepted and decrypted using man… |
CVE-2017-1370 | Medium | 4.9 | 2017-07-31 | IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could disclose sensitive information, including user credentials, through an error message from the Report Builder… |
CVE-2017-1332 | Medium | 6.1 | 2017-07-31 | IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2017-1303 | Medium | 6.1 | 2017-07-31 | IBM WebSphere Portal and Web Content Manager 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2017-1227 | High | 7.5 | 2017-07-31 | IBM Tivoli Endpoint Manager could allow a unauthorized user to consume all resources and crash the system. IBM X-Force ID: 123906. |
CVE-2016-9719 | Medium | 5.7 | 2017-07-31 | IBM InfoSphere Master Data Management Server 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 could allow a remote attacker to hijack the clicking action of the victim… |
CVE-2016-9718 | Medium | 5.4 | 2017-07-31 | IBM InfoSphere Master Data Management Server 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to e… |
CVE-2016-9717 | Medium | 6.5 | 2017-07-31 | HTTP Parameter Override is identified in the IBM Infosphere Master Data Management (MDM) 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 product. It enables attackers b… |
CVE-2016-9716 | High | 8.8 | 2017-07-31 | IBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to exec… |
CVE-2016-9715 | Medium | 5.4 | 2017-07-31 | IBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed a… |
CVE-2016-9714 | High | 8.8 | 2017-07-31 | IBM InfoSphere Master Data Management Server 10.1, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker t… |
CVE-2017-1382 | High | 7.1 | 2017-07-24 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default permissions instead of the customized permissions when custom star… |
CVE-2017-1380 | Medium | 5.4 | 2017-07-24 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2017-1287 | Medium | 5.4 | 2017-07-24 | IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a special… |
CVE-2017-1249 | Medium | 5.4 | 2017-07-24 | IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2017-1245 | Medium | 5.4 | 2017-07-24 | IBM Rational Software Architect Design Manager 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2016-8975 | Medium | 5.4 | 2017-07-24 | IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2016-6118 | Medium | 5.4 | 2017-07-24 | IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2017-1381 | Low | 3.3 | 2017-07-21 | IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, ca… |
CVE-2017-1374 | Medium | 6.5 | 2017-07-21 | Sensitive data can be exposed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 that can lead to an attacker gaining unauthorized access to the system… |
CVE-2017-1373 | High | 8.8 | 2017-07-21 | Reports executed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user to execute a report… |
CVE-2017-1372 | Medium | 5.4 | 2017-07-21 | IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2017-1371 | High | 8.8 | 2017-07-21 | Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user to execute Buil… |
CVE-2017-1267 | High | 7.5 | 2017-07-21 | IBM Security Guardium 10.0 and 10.1 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code. IBM… |
CVE-2017-1309 | High | 7.8 | 2017-07-19 | IBM InfoSphere Master Data Management Server 11.0 - 11.6 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1254… |
CVE-2017-1224 | High | 7.5 | 2017-07-19 | IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2017-1223 | Medium | 6.1 | 2017-07-19 | IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a special… |
CVE-2017-1219 | Medium | 6.5 | 2017-07-19 | IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulner… |
CVE-2017-1218 | High | 8.8 | 2017-07-19 | IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2017-1203 | Medium | 6.1 | 2017-07-19 | IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to emb… |
CVE-2016-6018 | Medium | 4.3 | 2017-07-19 | IBM Emptoris Contract Management 10.0 and 10.1 reveals detailed error messages in certain features that could cause an attacker to gain additional information… |
CVE-2017-1318 | High | 8.8 | 2017-07-18 | IBM MQ Appliance 8.0 and 9.0 could allow an authenticated messaging administrator to execute arbitrary commands on the system, caused by command execution. IBM… |
CVE-2017-1183 | High | 7.5 | 2017-07-17 | IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to modify SQL commands to the Portal Server, when default client-server communi… |
CVE-2017-1182 | High | 7.5 | 2017-07-17 | IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to execute arbitrary commands on the system, when default client-server default… |
CVE-2017-1181 | High | 7.0 | 2017-07-17 | IBM Tivoli Monitoring Portal V6 client could allow a local attacker to gain elevated privileges for IBM Tivoli Monitoring, caused by the default console connec… |
CVE-2017-1308 | Medium | 6.5 | 2017-07-13 | IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due t… |
CVE-2016-8964 | Critical | 9.8 | 2017-07-13 | IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 1… |
CVE-2016-8952 | Medium | 5.4 | 2017-07-13 | IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arb… |
CVE-2016-8951 | High | 7.5 | 2017-07-13 | IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack. An attacker can exploit a vulnerabilit… |
CVE-2016-6019 | Medium | 5.4 | 2017-07-13 | IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arb… |
CVE-2017-1321 | Medium | 6.1 | 2017-07-12 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1285 | Medium | 6.5 | 2017-07-12 | IBM WebSphere MQ 9.0.1 and 9.0.2 could allow an authenticated user with authority to send a specially crafted message that would cause a channel to remain in a… |
CVE-2016-8953 | Medium | 5.4 | 2017-07-12 | IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to… |
CVE-2016-8950 | Medium | 5.4 | 2017-07-12 | IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2016-8948 | Medium | 5.4 | 2017-07-12 | IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2016-8947 | Medium | 6.1 | 2017-07-12 | IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to… |
CVE-2016-8946 | Medium | 5.4 | 2017-07-12 | IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2016-6114 | Medium | 5.4 | 2017-07-12 | IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2017-1398 | Medium | 6.1 | 2017-07-10 | IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an o… |
CVE-2017-1337 | High | 8.1 | 2017-07-10 | IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. IBM X-Force ID: 126245. |
CVE-2017-1284 | Medium | 4.7 | 2017-07-10 | IBM WebSphere MQ 9.0.1 and 9.0.2 could allow a local user with ability to run or enable trace, to obtain sensitive information from WebSphere Application Serve… |
CVE-2017-1236 | Medium | 6.5 | 2017-07-06 | IBM WebSphere MQ 9.0.2 could allow an authenticated user to potentially cause a denial of service by saving an incorrect channel status inquiry. IBM X-Force ID… |
CVE-2017-1264 | High | 7.5 | 2017-07-05 | IBM Security Guardium 10.0 does not prove or insufficiently proves that the actors identity is correct which can lead to exposure of resources or functionality… |
CVE-2017-1254 | High | 7.1 | 2017-07-05 | IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnera… |
CVE-2017-1253 | Critical | 9.9 | 2017-07-05 | IBM Security Guardium 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an… |
CVE-2017-1157 | Medium | 4.3 | 2017-07-05 | IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could allow an authenticated attacker to access report data that should be restricted to authorized users. IBM X-F… |
CVE-2017-1144 | Low | 2.5 | 2017-07-05 | IBM WebSphere Message Broker could allow a local user with specialized access to prevent the message broker from starting. IBM X-Force ID: 122033. |
CVE-2017-1096 | Medium | 5.4 | 2017-07-05 | IBM Jazz Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2016-9989 | Medium | 5.4 | 2017-07-05 | IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2016-9988 | Medium | 5.4 | 2017-07-05 | IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2016-9987 | Medium | 5.4 | 2017-07-05 | IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2016-9986 | Medium | 5.4 | 2017-07-05 | IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2016-9700 | Medium | 4.3 | 2017-07-05 | IBM Jazz Foundation could allow an authenticated attacker to obtain sensitive information from error message stack traces. IBM X-Force ID: 119528. |
CVE-2017-1208 | Medium | 5.4 | 2017-07-05 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |