Vendor CVEs

IBM

All CVEs

8,287 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2017-1327	IBM Lotus Inotes	Med	0.40	6.1	0.01	Aug 3, 2017	IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126062.
CVE-2017-1500	IBM Worklight	Med	0.40	6.1	0.01	Aug 1, 2017	A Reflected Cross Site Scripting (XSS) vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1, 6.2, 6.3, 7.0, 7.1, and 8.0. The vulnerable parameter is "scope"; if you set as its value a "realm" not defined in…
CVE-2017-1332	IBM Lotus Inotes	Med	0.40	6.1	0.01	Jul 31, 2017	IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126234.
CVE-2017-1303	IBM Websphere Portal	Med	0.40	6.1	0.01	Jul 31, 2017	IBM WebSphere Portal and Web Content Manager 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…
CVE-2017-1223	IBM Tivoli Endpoint Manager	Med	0.40	6.1	0.01	Jul 19, 2017	IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to…
CVE-2017-1203	IBM Tivoli Endpoint Manager	Med	0.40	6.1	0.01	Jul 19, 2017	IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
CVE-2017-1321	IBM Infosphere Information Server	Med	0.40	6.1	0.01	Jul 12, 2017	IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2016-8947	IBM Emptoris Sourcing	Med	0.40	6.1	0.01	Jul 12, 2017	IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to…
CVE-2017-1398	IBM Websphere Commerce	Med	0.40	6.1	0.01	Jul 10, 2017	IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this…
CVE-2017-1256	IBM Security Guardium	Med	0.40	6.1	0.01	Jul 5, 2017	IBM Security Guardium 10.0, 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2017-1217	IBM Websphere Portal	Med	0.40	6.1	0.01	Jul 5, 2017	IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2017-1304	IBM Elastic Storage Server	Med	0.40	6.2	0.00	Jun 21, 2017	IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported configuration, where users applications are running on an active ESS I/O server node and utilize direct I/O to…
CVE-2017-1178	IBM Endpoint Manager for Security and Compliance	Med	0.40	6.1	0.01	Jun 7, 2017	IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2017-1325	IBM Lotus Inotes	Med	0.40	6.1	0.01	May 26, 2017	IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125976.
CVE-2016-0255	IBM Marketing Platform	Med	0.40	6.1	0.01	May 5, 2017	IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser…
CVE-2016-9990	IBM Lotus Inotes	Med	0.40	6.1	0.01	Mar 31, 2017	IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #:…
CVE-2017-1120	IBM Websphere Portal	Med	0.40	6.1	0.01	Mar 27, 2017	IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference…
CVE-2016-9723	IBM Qradar Security Information And Event Manager	Med	0.40	6.1	0.01	Mar 7, 2017	IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999534.
CVE-2016-9693	IBM Business Process Manager	Med	0.40	6.1	0.01	Mar 7, 2017	IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the…
CVE-2016-8232	IBM Advanced Management Module	Med	0.40	6.1	0.01	Mar 1, 2017	Document Object Model-(DOM) based cross-site scripting vulnerability in the Advanced Management Module (AMM) versions earlier than 66Z of Lenovo IBM BladeCenter HS22, HS22V, HS23, HS23E, HX5 allows an unauthenticated attacker with access to the AMM's IP address to send a crafted…
CVE-2016-5883	IBM Lotus Inotes	Med	0.40	6.1	0.01	Feb 23, 2017	IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #:…
CVE-2016-6062	IBM Resilient	Med	0.40	6.1	0.01	Feb 16, 2017	IBM Resilient v26.0, v26.1, and v26.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2016-9010	IBM Websphere Message Broker	Med	0.40	6.1	0.01	Feb 15, 2017	IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch…
CVE-2016-5902	IBM Maximo Asset Management	Med	0.40	6.1	0.01	Feb 8, 2017	IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-6096	IBM Security Key Lifecycle Manager	Med	0.40	6.1	0.01	Feb 7, 2017	IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2016-6092	IBM Security Key Lifecycle Manager	Med	0.40	6.2	0.00	Feb 7, 2017	IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user.
CVE-2016-9704	IBM Security Identity Manager Virtual Appliance	Med	0.40	6.1	0.01	Feb 1, 2017	IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-9000	IBM Infosphere Datastage	Med	0.40	6.1	0.01	Feb 1, 2017	IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this…
CVE-2016-5881	IBM Lotus Inotes	Med	0.40	6.1	0.01	Feb 1, 2017	IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-8961	IBM Bigfix Inventory	Med	0.40	6.1	0.01	Feb 1, 2017	IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a…
CVE-2016-8936	IBM Social Rendering Templates For Digital Data Connector	Med	0.40	6.1	0.01	Feb 1, 2017	IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2016-8922	Exphox WebRadar	Med	0.40	6.1	0.01	Feb 1, 2017	Exphox WebRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-6113	IBM Verse	Med	0.40	6.1	0.01	Feb 1, 2017	IBM Verse is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-6020	IBM Sterling B2b Integrator	Med	0.40	6.1	0.01	Feb 1, 2017	IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to…
CVE-2016-6000	IBM Tririga Application Platform	Med	0.40	6.1	0.01	Feb 1, 2017	IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-5984	IBM Infosphere Information Server	Med	0.40	6.1	0.01	Feb 1, 2017	IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this…
CVE-2016-5884	IBM Lotus Domino	Med	0.40	6.1	0.01	Feb 1, 2017	IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-5882	IBM Lotus Domino	Med	0.40	6.1	0.01	Feb 1, 2017	IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-3018	IBM Security Access Manager for Web	Med	0.40	6.1	0.01	Feb 1, 2017	IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-2939	IBM Lotus Domino	Med	0.40	6.1	0.01	Feb 1, 2017	IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-2938	IBM Lotus Domino	Med	0.40	6.1	0.01	Feb 1, 2017	IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-3057	IBM Sterling B2b Integrator	Med	0.40	6.1	0.01	Nov 30, 2016	Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.2 before 5020500_14 and 5.2 06 before 5020602_1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-2934	IBM Bigfix Remote Control	Med	0.40	6.1	0.01	Nov 30, 2016	Cross-site scripting (XSS) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-0246	IBM Security Guardium	Med	0.40	6.1	0.01	Oct 22, 2016	Cross-site scripting (XSS) vulnerability in IBM Security Guardium 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2016-6027	IBM Sterling Secure Proxy	Med	0.40	6.1	0.01	Oct 6, 2016	The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information or modify data by leveraging use of…
CVE-2016-0293	IBM Bigfix Platform	Med	0.40	6.1	0.01	Sep 1, 2016	Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file.
CVE-2016-3059	IBM Tivoli Storage Manager for Databases	Med	0.40	6.2	0.00	Aug 8, 2016	IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka IBM Spectrum Protect for Databases) 6.3 before 6.3.1.7 and 6.4 before 6.4.1.9 and Tivoli Storage FlashCopy Manager for Microsoft SQL Server (aka IBM Spectrum Protect Snapshot) 3.1 before…
CVE-2016-0321	IBM Personal Communications	Med	0.40	6.2	0.00	Jul 17, 2016	IBM Personal Communications (aka PCOMM) 6.x before 6.0.17 and 12.x before 12.0.0.1 does not properly restrict credential extraction, which allows local users to discover passwords by leveraging access to the victim account and executing a PowerShell script.
CVE-2016-0338	IBM Security Identity Manager Adapter	Med	0.40	6.2	0.00	Jul 15, 2016	IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows local users to discover cleartext passwords by (1) reading a configuration file or (2) examining a process.
CVE-2016-2862	IBM Websphere Commerce	Med	0.40	6.1	0.01	Jul 3, 2016	Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 before 7.0.0.9 cumulative iFix 3, and 8.0 before 8.0.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2017-1327MedAug 3, 2017
IBM
Lotus Inotes
risk 0.40cvss 6.1epss 0.01
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126062.
CVE-2017-1500MedAug 1, 2017
IBM
Worklight
risk 0.40cvss 6.1epss 0.01
A Reflected Cross Site Scripting (XSS) vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1, 6.2, 6.3, 7.0, 7.1, and 8.0. The vulnerable parameter is "scope"; if you set as its value a "realm" not defined in…
CVE-2017-1332MedJul 31, 2017
IBM
Lotus Inotes
risk 0.40cvss 6.1epss 0.01
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126234.
CVE-2017-1303MedJul 31, 2017
IBM
Websphere Portal
risk 0.40cvss 6.1epss 0.01
IBM WebSphere Portal and Web Content Manager 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…
CVE-2017-1223MedJul 19, 2017
IBM
Tivoli Endpoint Manager
risk 0.40cvss 6.1epss 0.01
IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to…
CVE-2017-1203MedJul 19, 2017
IBM
Tivoli Endpoint Manager
risk 0.40cvss 6.1epss 0.01
IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
CVE-2017-1321MedJul 12, 2017
IBM
Infosphere Information Server
risk 0.40cvss 6.1epss 0.01
IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2016-8947MedJul 12, 2017
IBM
Emptoris Sourcing
risk 0.40cvss 6.1epss 0.01
IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to…
CVE-2017-1398MedJul 10, 2017
IBM
Websphere Commerce
risk 0.40cvss 6.1epss 0.01
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this…
CVE-2017-1256MedJul 5, 2017
IBM
Security Guardium
risk 0.40cvss 6.1epss 0.01
IBM Security Guardium 10.0, 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2017-1217MedJul 5, 2017
IBM
Websphere Portal
risk 0.40cvss 6.1epss 0.01
IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2017-1304MedJun 21, 2017
IBM
Elastic Storage Server
risk 0.40cvss 6.2epss 0.00
IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported configuration, where users applications are running on an active ESS I/O server node and utilize direct I/O to…
CVE-2017-1178MedJun 7, 2017
IBM
Endpoint Manager for Security and Compliance
risk 0.40cvss 6.1epss 0.01
IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2017-1325MedMay 26, 2017
IBM
Lotus Inotes
risk 0.40cvss 6.1epss 0.01
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125976.
CVE-2016-0255MedMay 5, 2017
IBM
Marketing Platform
risk 0.40cvss 6.1epss 0.01
IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser…
CVE-2016-9990MedMar 31, 2017
IBM
Lotus Inotes
risk 0.40cvss 6.1epss 0.01
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #:…
CVE-2017-1120MedMar 27, 2017
IBM
Websphere Portal
risk 0.40cvss 6.1epss 0.01
IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference…
CVE-2016-9723MedMar 7, 2017
IBM
Qradar Security Information And Event Manager
risk 0.40cvss 6.1epss 0.01
IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999534.
CVE-2016-9693MedMar 7, 2017
IBM
Business Process Manager
risk 0.40cvss 6.1epss 0.01
IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the…
CVE-2016-8232MedMar 1, 2017
IBM
Advanced Management Module
risk 0.40cvss 6.1epss 0.01
Document Object Model-(DOM) based cross-site scripting vulnerability in the Advanced Management Module (AMM) versions earlier than 66Z of Lenovo IBM BladeCenter HS22, HS22V, HS23, HS23E, HX5 allows an unauthenticated attacker with access to the AMM's IP address to send a crafted…
CVE-2016-5883MedFeb 23, 2017
IBM
Lotus Inotes
risk 0.40cvss 6.1epss 0.01
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #:…
CVE-2016-6062MedFeb 16, 2017
IBM
Resilient
risk 0.40cvss 6.1epss 0.01
IBM Resilient v26.0, v26.1, and v26.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2016-9010MedFeb 15, 2017
IBM
Websphere Message Broker
risk 0.40cvss 6.1epss 0.01
IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch…
CVE-2016-5902MedFeb 8, 2017
IBM
Maximo Asset Management
risk 0.40cvss 6.1epss 0.01
IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-6096MedFeb 7, 2017
IBM
Security Key Lifecycle Manager
risk 0.40cvss 6.1epss 0.01
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2016-6092MedFeb 7, 2017
IBM
Security Key Lifecycle Manager
risk 0.40cvss 6.2epss 0.00
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user.
CVE-2016-9704MedFeb 1, 2017
IBM
Security Identity Manager Virtual Appliance
risk 0.40cvss 6.1epss 0.01
IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-9000MedFeb 1, 2017
IBM
Infosphere Datastage
risk 0.40cvss 6.1epss 0.01
IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this…
CVE-2016-5881MedFeb 1, 2017
IBM
Lotus Inotes
risk 0.40cvss 6.1epss 0.01
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-8961MedFeb 1, 2017
IBM
Bigfix Inventory
risk 0.40cvss 6.1epss 0.01
IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a…
CVE-2016-8936MedFeb 1, 2017
IBM
Social Rendering Templates For Digital Data Connector
risk 0.40cvss 6.1epss 0.01
IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2016-8922MedFeb 1, 2017
Exphox
WebRadar
risk 0.40cvss 6.1epss 0.01
Exphox WebRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-6113MedFeb 1, 2017
IBM
Verse
risk 0.40cvss 6.1epss 0.01
IBM Verse is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-6020MedFeb 1, 2017
IBM
Sterling B2b Integrator
risk 0.40cvss 6.1epss 0.01
IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to…
CVE-2016-6000MedFeb 1, 2017
IBM
Tririga Application Platform
risk 0.40cvss 6.1epss 0.01
IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-5984MedFeb 1, 2017
IBM
Infosphere Information Server
risk 0.40cvss 6.1epss 0.01
IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this…
CVE-2016-5884MedFeb 1, 2017
IBM
Lotus Domino
risk 0.40cvss 6.1epss 0.01
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-5882MedFeb 1, 2017
IBM
Lotus Domino
risk 0.40cvss 6.1epss 0.01
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-3018MedFeb 1, 2017
IBM
Security Access Manager for Web
risk 0.40cvss 6.1epss 0.01
IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-2939MedFeb 1, 2017
IBM
Lotus Domino
risk 0.40cvss 6.1epss 0.01
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-2938MedFeb 1, 2017
IBM
Lotus Domino
risk 0.40cvss 6.1epss 0.01
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2016-3057MedNov 30, 2016
IBM
Sterling B2b Integrator
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.2 before 5020500_14 and 5.2 06 before 5020602_1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-2934MedNov 30, 2016
IBM
Bigfix Remote Control
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-0246MedOct 22, 2016
IBM
Security Guardium
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Security Guardium 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2016-6027MedOct 6, 2016
IBM
Sterling Secure Proxy
risk 0.40cvss 6.1epss 0.01
The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information or modify data by leveraging use of…
CVE-2016-0293MedSep 1, 2016
IBM
Bigfix Platform
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file.
CVE-2016-3059MedAug 8, 2016
IBM
Tivoli Storage Manager for Databases
risk 0.40cvss 6.2epss 0.00
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka IBM Spectrum Protect for Databases) 6.3 before 6.3.1.7 and 6.4 before 6.4.1.9 and Tivoli Storage FlashCopy Manager for Microsoft SQL Server (aka IBM Spectrum Protect Snapshot) 3.1 before…
CVE-2016-0321MedJul 17, 2016
IBM
Personal Communications
risk 0.40cvss 6.2epss 0.00
IBM Personal Communications (aka PCOMM) 6.x before 6.0.17 and 12.x before 12.0.0.1 does not properly restrict credential extraction, which allows local users to discover passwords by leveraging access to the victim account and executing a PowerShell script.
CVE-2016-0338MedJul 15, 2016
IBM
Security Identity Manager Adapter
risk 0.40cvss 6.2epss 0.00
IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows local users to discover cleartext passwords by (1) reading a configuration file or (2) examining a process.
CVE-2016-2862MedJul 3, 2016
IBM
Websphere Commerce
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 before 7.0.0.9 cumulative iFix 3, and 8.0 before 8.0.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Page 15 of 166