VYPR
← IBM

Vendor CVEs

IBM

All CVEs

8,292 total · sorted by risk
  • CVE-2013-3041Oct 1, 2013
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    The Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to obtain sensitive information from the client-server data stream via unspecified vectors associated with a "JSON hijacking attack."

  • CVE-2013-0598Sep 28, 2013
    IBM
    Rational Clearquest
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2013-5403Sep 27, 2013
    IBM
    Websphere Datapower Xc10 Appliance
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability on the IBM WebSphere DataPower XC10 appliance 2.0 through 2.5.0.1 allows remote attackers to obtain administrative access via unknown vectors.

  • CVE-2013-5373Sep 25, 2013
    IBM
    Rational Clearcase
    risk 0.00cvss —epss 0.00

    The RemoteClient component in IBM Rational ClearCase 8.0.0.03 through 8.0.0.07, and 8.0.1, uses world-writable permissions for the rcleartool script, which allows local users to gain privileges by appending commands.

  • CVE-2013-4025Sep 25, 2013
    IBM
    Optim Performance Manager
    risk 0.00cvss —epss 0.00

    IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x do not have an off autocomplete attribute for the login-password field, which makes it easier for remote…

  • CVE-2013-4024Sep 25, 2013
    IBM
    Optim Performance Manager
    risk 0.00cvss —epss 0.01

    IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x support HTTP access to the Web Console, which allows remote attackers to read session cookies by sniffing the…

  • CVE-2013-4022Sep 25, 2013
    IBM
    Optim Performance Manager
    risk 0.00cvss —epss 0.01

    IBM Data Studio Web Console 3.x before 3.2, Optim Performance Manager 5.x before 5.2, InfoSphere Optim Configuration Manager 2.x before 2.2, and DB2 Recovery Expert 2.x store unspecified authentication information in a cookie, which allows remote authenticated users to bypass…

  • CVE-2013-4053Sep 20, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    The WS-Security implementation in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1, and WAS Feature Pack for Web Services 6.1 before 6.1.0.47, when a trust store is configured for XML Digital Signatures,…

  • CVE-2013-4052Sep 20, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the UDDI Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2013-0596Sep 20, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-4068Sep 20, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.04

    Buffer overflow in iNotes in IBM Domino 8.5.3 before FP5 IF1 and 9.0 before IF4 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka SPR PTHN9ADPA8.

  • CVE-2013-5369Sep 16, 2013
    IBM
    Spss Analytical Decision Management
    risk 0.00cvss —epss 0.03

    IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 might allow remote attackers to execute arbitrary code by deploying and accessing a service.

  • CVE-2013-4049Sep 16, 2013
    IBM
    Spss Analytical Decision Management
    risk 0.00cvss —epss 0.02

    Unrestricted file upload vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 allows remote authenticated users to execute arbitrary code by uploading and accessing a JSP file.

  • CVE-2013-4048Sep 16, 2013
    IBM
    Spss Analytical Decision Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving addition of script to a page.

  • CVE-2013-4047Sep 16, 2013
    IBM
    Spss Analytical Decision Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1, 6.2 before IF1, and 7.0 before FP1 IF6 allows remote attackers to inject arbitrary web script or HTML via a crafted link.

  • CVE-2013-3039Sep 12, 2013
    IBM
    Rational Requirements Composer
    risk 0.00cvss —epss 0.00

    IBM Rational Requirements Composer before 4.0.4 does not properly perform authentication, which has unspecified impact and remote attack vectors.

  • CVE-2013-3038Sep 12, 2013
    IBM
    Rational Requirements Composer
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in IBM Rational Requirements Composer before 4.0.4 makes it easier for remote attackers to discover credentials via unknown vectors.

  • CVE-2013-3037Sep 12, 2013
    IBM
    Rational Requirements Composer
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in IBM Rational Requirements Composer before 4.0.4 makes it easier for local users to gain privileges via unknown vectors.

  • CVE-2013-3036Sep 12, 2013
    IBM
    Rational Requirements Composer
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in IBM Rational Requirements Composer before 4.0.4 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.

  • CVE-2013-2992Sep 9, 2013
    IBM
    Websphere Commerce
    risk 0.00cvss —epss 0.02

    The Search component in IBM WebSphere Commerce 7.0 FP4 through FP6, in certain search-term association configurations, allows remote attackers to cause a denial of service via a crafted query.

  • CVE-2013-4062Sep 9, 2013
    IBM
    Rational Policy Tester
    risk 0.00cvss —epss 0.01

    IBM Rational Policy Tester 8.5 before 8.5.0.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof Jazz Team servers, obtain sensitive information, and modify the client-server data stream via a crafted certificate.

  • CVE-2013-4061Sep 9, 2013
    IBM
    Rational Policy Tester
    risk 0.00cvss —epss 0.01

    IBM Rational Policy Tester 8.5 before 8.5.0.5 does not properly check authorization for changes to the set of authentication hosts, which allows remote authenticated users to perform spoofing attacks involving an HTTP redirect via unspecified vectors.

  • CVE-2013-3031Sep 9, 2013
    IBM
    Soliddb
    risk 0.00cvss —epss 0.01

    A SQL stored procedure in the Universal Cache component in IBM solidDB 6.0.x before 6.0.1070, 6.3.x before 6.3.0.56, 6.5.x before 6.5.0.12, and 7.0.x before 7.0.0.4 allows remote authenticated users to cause a denial of service (uninitialized-memory access and daemon crash) via…

  • CVE-2013-2997Sep 8, 2013
    IBM
    Security Appscan
    risk 0.00cvss —epss 0.00

    IBM Security AppScan Enterprise before 8.7 does not invalidate the session context upon a logout action, which allows remote attackers to hijack sessions by leveraging an unattended workstation.

  • CVE-2013-0531Sep 8, 2013
    IBM
    Security Appscan
    risk 0.00cvss —epss 0.01

    The SSL implementation in IBM Security AppScan Enterprise before 8.7.0.1 enables cipher suites with weak encryption algorithms, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2013-4003Aug 29, 2013
    IBM
    Tririga Application Platform
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3.1.1, and 8, allow remote authenticated users to inject arbitrary web script or HTML via (1) unspecified input to WebProcess.srv, (2) unspecified input to…

  • CVE-2013-4039Aug 28, 2013
    IBM
    Websphere Extended Deployment Compute Grid
    risk 0.00cvss —epss 0.02

    IBM WebSphere Extended Deployment Compute Grid 8.0 before 8.0.0.3 allows remote authenticated users to obtain sensitive information, and consequently bypass intended access restrictions on jobs, via unspecified vectors.

  • CVE-2013-4033Aug 28, 2013
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 and DB2 Connect 9.7 through FP8, 9.8 through FP5, 10.1 through FP2, and 10.5 through FP1 allow remote authenticated users to execute DML statements by leveraging EXPLAIN authority.

  • CVE-2013-2988Aug 27, 2013
    IBM
    Cognos Business Intelligence
    risk 0.00cvss —epss 0.02

    Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than CVE-2013-2978.

  • CVE-2013-2978Aug 27, 2013
    IBM
    Cognos Business Intelligence
    risk 0.00cvss —epss 0.01

    Absolute path traversal vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to read files by leveraging the Report Author privilege, a different vulnerability than CVE-2013-2988.

  • CVE-2013-0595Aug 27, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3.

  • CVE-2013-0591Aug 27, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3, a different vulnerability than CVE-2013-0590.

  • CVE-2013-0590Aug 27, 2013
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3, a different vulnerability than CVE-2013-0591.

  • CVE-2013-0586Aug 27, 2013
    IBM
    Cognos Business Intelligence
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-0566Aug 27, 2013
    IBM
    Websphere Commerce
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the (1) Accelerator JSPs, (2) Organization Administration Console JSPs, and (3) Administration Console JSPs in WebSphere Commerce Tools in IBM WebSphere Commerce 5.6.1.0 through 5.6.1.5, 6.0.0.0 through 6.0.0.11, and 7.0.0.0…

  • CVE-2013-2979Aug 22, 2013
    IBM
    Optim Performance Manager
    risk 0.00cvss —epss 0.01

    Directory traversal vulnerability in IBM Optim Performance Manager 4.1.1 and IBM InfoSphere Optim Performance Manager 5.x before 5.2 allows remote authenticated users to read arbitrary files via a crafted URL.

  • CVE-2013-4005Aug 21, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via…

  • CVE-2013-4004Aug 21, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 8.0 before 8.0.0.7 and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3029Aug 21, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.1 allows remote attackers to hijack the authentication of arbitrary users…

  • CVE-2013-2976Aug 21, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.00

    The Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 does not properly perform caching, which allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2013-2967Aug 21, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified…

  • CVE-2013-0597Aug 21, 2013
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0, when OAuth is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3016Aug 21, 2013
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    IBM WebSphere Portal 6.1, 7.0, and 8.0 allows remote attackers to access the user directory via a crafted request for a servlet, related to the serveServletsByClassnameEnabled setting.

  • CVE-2013-4007Aug 16, 2013
    IBM
    Advanced Management Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in adv_sw.php in the Advanced Management Module (AMM) with firmware BBET before BBET64G and BPET before BPET64G for IBM BladeCenter systems allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2013-3040Aug 16, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 produces login-failure messages indicating whether the username or password is incorrect, which allows remote attackers to enumerate user accounts via a brute-force attack.

  • CVE-2013-3034Aug 16, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the web console.

  • CVE-2013-0587Aug 16, 2013
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Portal before 8.0.0.1 CF07 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Portal, (2) Portal 7.0.0.2, (3) Portal 8.0, or (4) PortalWeb2 theme.

  • CVE-2013-0585Aug 16, 2013
    IBM
    Infosphere Information Server
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to the (1) web console and (2) repository management…

  • CVE-2013-4038Aug 9, 2013
    IBM
    Bladecenter
    risk 0.00cvss —epss 0.01

    The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers uses cleartext for password storage, which allows context-dependent attackers to obtain…

  • CVE-2013-4037Aug 9, 2013
    IBM
    Bladecenter
    risk 0.00cvss —epss 0.01

    The RAKP protocol support in the Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Management Module II (IMM2) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers sends a password hash…

Page 137 of 166