IBM
Page 53 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1207 | Medium | 5.5 | 2017-07-05 | IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777. |
CVE-2017-1176 | Low | 3.3 | 2017-07-05 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local user to obtain sensitive information due to inappropriate data retention of attachments. IBM… |
CVE-2017-1175 | Critical | 9.8 | 2017-07-05 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow… |
CVE-2017-1113 | Medium | 5.4 | 2017-07-05 | IBM Rational Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2016-9746 | Medium | 5.4 | 2017-07-05 | IBM Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2016-9733 | Medium | 5.4 | 2017-07-05 | IBM Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2016-9701 | Medium | 5.4 | 2017-07-05 | IBM Team Concert 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2017-1269 | Critical | 9.8 | 2017-07-05 | IBM Security Guardium 10.0 and 10.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attack… |
CVE-2017-1258 | Medium | 6.5 | 2017-07-05 | IBM Security Guardium 10.0 and 10.1 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protec… |
CVE-2017-1256 | Medium | 6.1 | 2017-07-05 | IBM Security Guardium 10.0, 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2017-1217 | Medium | 6.1 | 2017-07-05 | IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-0238 | Low | 3.7 | 2017-07-05 | IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain s… |
CVE-2017-1310 | Medium | 6.5 | 2017-06-29 | IBM Informix Dynamic Server 12.1 could allow an authenticated user to cause a buffer overflow that would write large assertion fail files to the server. Done e… |
CVE-2017-1106 | Medium | 5.4 | 2017-06-28 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1328 | Medium | 5.3 | 2017-06-27 | IBM API Connect 5.0.0.0 - 5.0.6.0 could allow a remote attacker to bypass security restrictions of the api, caused by improper handling of security policy. By… |
CVE-2017-1322 | High | 8.2 | 2017-06-27 | IBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerabi… |
CVE-2017-1297 | High | 7.3 | 2017-06-27 | IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow, caused by improper… |
CVE-2017-1234 | Medium | 5.4 | 2017-06-27 | IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2017-1105 | High | 7.1 | 2017-06-27 | IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a buffer overflow that could allow a local user to… |
CVE-2016-9972 | Medium | 5.9 | 2017-06-27 | IBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security… |
CVE-2016-9738 | High | 7.5 | 2017-06-27 | IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IB… |
CVE-2016-6083 | Medium | 5.3 | 2017-06-27 | IBM Tivoli Monitoring V6 could allow an unauthenticated user to access SOAP queries that could contain sensitive information. IBM X-Force ID: 117696. |
CVE-2017-1349 | Medium | 5.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 stores potentially sensitive information from HTTP sessions that could be read by a local user. IBM X-Force ID… |
CVE-2017-1348 | Medium | 5.4 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2017-1347 | High | 8.8 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could all… |
CVE-2017-1302 | Medium | 5.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow a local user view sensitive information due to improper access controls. IBM X-Force ID: 125456. |
CVE-2017-1193 | Medium | 6.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow user to obtain sensitive information using an HTTP GET request. IBM X-Force ID: 123667. |
CVE-2017-1132 | Medium | 5.4 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2017-1131 | Medium | 6.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user to obtain sensitive information by using unsupported, specially crafted HTTP… |
CVE-2016-5893 | Medium | 5.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 115336. |
CVE-2017-1326 | Medium | 4.3 | 2017-06-22 | IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by m… |
CVE-2016-9983 | Medium | 5.3 | 2017-06-22 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user with special privileges to view files that they should not have access to. I… |
CVE-2016-9982 | Medium | 6.5 | 2017-06-22 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user to obtain sensitive information such as account lists due to improper access… |
CVE-2016-9747 | Medium | 5.4 | 2017-06-22 | IBM RELM 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2017-1304 | Medium | 6.2 | 2017-06-21 | IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an uns… |
CVE-2017-1117 | Medium | 5.3 | 2017-06-21 | IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a denial of service to the MQXR channel when trace is enabled. IBM X-Force ID: 121155. |
CVE-2017-3744 | Medium | 6.5 | 2017-06-20 | In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) ser… |
CVE-2017-1379 | High | 7.5 | 2017-06-15 | IBM API Connect 5.0.0.0 could allow a remote attacker to obtain sensitive information, caused by improper handling of requests to the Developer Portal. IBM X-F… |
CVE-2017-1197 | Critical | 9.8 | 2017-06-15 | IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IB… |
CVE-2017-1104 | Medium | 5.4 | 2017-06-13 | IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2017-1102 | Medium | 5.4 | 2017-06-13 | IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2017-1101 | Medium | 5.4 | 2017-06-13 | IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2017-1100 | Medium | 5.4 | 2017-06-13 | IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2017-1099 | Medium | 4.3 | 2017-06-13 | IBM Jazz Foundation could expose potentially sensitive information to authenticated users through stack trace error conditions. IBM X-Force ID: 120659. |
CVE-2016-9984 | High | 8.8 | 2017-06-13 | IBM Maximo Asset Management 7.5 and 7.6 could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator. IBM X-Force I… |
CVE-2016-9973 | Medium | 5.4 | 2017-06-13 | IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the i… |
CVE-2017-1278 | Medium | 5.4 | 2017-06-12 | IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0 and 6.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, wo… |
CVE-2017-1276 | Medium | 5.4 | 2017-06-12 | IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1247 | Medium | 5.4 | 2017-06-12 | IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1214 | Medium | 5.7 | 2017-06-12 | IBM iNotes 8.5 and 9.0 could allow a remote attacker to send a malformed email to a victim, that when opened could cause an information disclosure. IBM X-Force… |
CVE-2017-1319 | High | 7.5 | 2017-06-08 | IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session (SSL) cookie. IBM X-Force ID: 1… |
CVE-2017-1179 | Medium | 5.9 | 2017-06-08 | IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2017-1140 | Medium | 5.4 | 2017-06-08 | IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2016-9991 | High | 8.0 | 2017-06-08 | IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized a… |
CVE-2016-9736 | Medium | 5.3 | 2017-06-08 | IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information. |
CVE-2016-9698 | High | 8.1 | 2017-06-08 | IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remo… |
CVE-2016-8987 | Medium | 4.3 | 2017-06-08 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access to view. |
CVE-2016-6098 | High | 8.1 | 2017-06-08 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or mo… |
CVE-2016-6093 | Critical | 9.8 | 2017-06-08 | IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user ac… |
CVE-2014-4843 | Medium | 5.3 | 2017-06-08 | Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote att… |
CVE-2017-1305 | Medium | 5.4 | 2017-06-07 | IBM DOORS Next Generation (DNG/RRC) 6.0.2 and 6.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2017-1196 | Critical | 9.8 | 2017-06-07 | IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to c… |
CVE-2017-1178 | Medium | 6.1 | 2017-06-07 | IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2017-1125 | Low | 3.3 | 2017-06-07 | IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Fo… |
CVE-2016-9977 | High | 8.8 | 2017-06-07 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session… |
CVE-2016-9710 | Medium | 5.3 | 2017-06-07 | IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted U… |
CVE-2016-8939 | Medium | 5.5 | 2017-06-07 | IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner which can be compro… |
CVE-2016-6089 | Medium | 5.5 | 2017-06-07 | IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to due to improper ac… |
CVE-2016-6087 | Critical | 9.8 | 2017-06-07 | IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key Exchange validation… |
CVE-2016-5960 | Medium | 5.5 | 2017-06-07 | IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1161… |
CVE-2016-5959 | Medium | 5.3 | 2017-06-07 | IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorize… |
CVE-2016-3051 | Medium | 4.3 | 2017-06-07 | IBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some privileged functionality of the server. IBM X-Force ID: 114714. |
CVE-2016-3019 | Medium | 6.5 | 2017-06-07 | IBM Security Access Manager for Web 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informati… |
CVE-2016-0254 | Medium | 6.5 | 2017-06-07 | IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML… |
CVE-2017-1325 | Medium | 6.1 | 2017-05-26 | IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2017-1292 | Medium | 5.3 | 2017-05-26 | IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attacks against the syst… |
CVE-2017-1291 | Medium | 5.4 | 2017-05-26 | IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-cr… |
CVE-2017-1320 | Medium | 5.4 | 2017-05-22 | IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2017-1289 | High | 8.2 | 2017-05-22 | IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnera… |
CVE-2017-1282 | Medium | 5.4 | 2017-05-22 | IBM Content Navigator & CMIS 2.0 and 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2017-1159 | Medium | 5.4 | 2017-05-22 | IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vi… |
CVE-2017-1092 | Critical | 9.8 | 2017-05-22 | IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID… |
CVE-2016-6112 | High | 8.8 | 2017-05-22 | IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative… |
CVE-2016-9750 | Medium | 6.5 | 2017-05-15 | IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 120207. |
CVE-2016-9735 | Medium | 4.3 | 2017-05-15 | IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID: 119781, |
CVE-2016-5979 | Low | 2.7 | 2017-05-15 | IBM Distributed Marketing 8.6, 9.0, and 10.0 could allow a privileged authenticated user to create an instance that gets created with security profile not vali… |
CVE-2017-1137 | High | 8.1 | 2017-05-10 | IBM WebSphere Application Server 8.0 and 8.5.5 could provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive i… |
CVE-2017-1103 | High | 8.1 | 2017-05-10 | IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker… |
CVE-2016-6037 | Medium | 4.8 | 2017-05-10 | IBM Rational Team Concert (RTC) is vulnerable to HTML injection. A remote attacker with project administrator privileges could send a project that contains mal… |
CVE-2016-6035 | Medium | 5.4 | 2017-05-10 | IBM Rational Quality Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2016-5889 | High | 8.8 | 2017-05-10 | IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tr… |
CVE-2016-5888 | Medium | 5.4 | 2017-05-10 | IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2016-3032 | Medium | 5.4 | 2017-05-10 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2017-1156 | High | 8.8 | 2017-05-05 | IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a sp… |
CVE-2016-9692 | High | 8.6 | 2017-05-05 | IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input… |
CVE-2016-9691 | High | 8.6 | 2017-05-05 | IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing… |
CVE-2016-8916 | Medium | 5.5 | 2017-05-05 | IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is is… |
CVE-2016-0255 | Medium | 6.1 | 2017-05-05 | IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could… |
CVE-2016-9976 | High | 8.4 | 2017-05-03 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL re… |
CVE-2016-2930 | High | 7.5 | 2017-05-03 | IBM BigFix Remote Control 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication. IBM X-Force ID: 5512. |