IBM Corporation vulnerabilities, page 3
287 vulnerabilities
Known vulnerabilities in IBM Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 84 products.
CVE-2016-9750ibm corporationqradar siem+1
EPSS score0.82%
IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 120207.CVE-2016-9703ibm corporationidentity manager+1EPSS score0.35%
IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information.CVE-2016-9692ibm corporationwebsphere cast iron cloud integration+1EPSS score1.61%
IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. IBM X-Force ID: 119516.CVE-2016-9739ibm corporationidentity manager+1EPSS score0.36%
IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user.CVE-2016-9697ibm corporationrational rhapsody design manager+1EPSS score0.66%
An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. A JSON Hijacking Attack may expose to an attacker information passed between the server and the browser. IBM Reference #: 1999960.CVE-2016-9006ibm corporationurbancode deploy+1EPSS score0.52%
IBM UrbanCode Deploy 6.1 and 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: C1000264.CVE-2016-9010ibm corporationintegration bus+2EPSS score0.77%
IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM Reference #: 1997906.CVE-2016-9729ibm corporationqradar siem+1EPSS score0.77%
IBM QRadar 7.2 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM Reference #: 1999545.CVE-2016-9990ibm corporationinotes+1EPSS score1.25%
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998824.CVE-2016-9985ibm corporationcognos business intelligence+1EPSS score0.30%
IBM Cognos Server 10.1.1 and 10.2 stores highly sensitive information in log files that could be read by a local user. IBM Reference #: 1999671.CVE-2016-9720ibm corporationqradar siem+2EPSS score0.86%
IBM QRadar 7.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM Reference #: 1999533.CVE-2016-9725ibm corporationqradar siem+1EPSS score0.86%
IBM QRadar Incident Forensics 7.2 allows for Cross-Origin Resource Sharing (CORS), which is a mechanism that allows web sites to request resources from external sites, avoiding the need to duplicate them. IBM Reference #: 1999539.CVE-2016-9975ibm corporationjazz for service management+1EPSS score0.45%
IBM Jazz for Service Management 1.1.2.1 and 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 1998714.CVE-2016-9706ibm corporationintegration bus+2EPSS score1.76%
IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1997918.CVE-2016-9748ibm corporationrational doors next generation+2EPSS score0.94%
IBM Rational DOORS Next Generation 5.0 and 6.0 discloses sensitive information in error response messages that could be used for further attacks against the system.CVE-2016-9009ibm corporationwebsphere mq+1EPSS score0.81%
IBM WebSphere MQ 8.0 could allow an authenticated user with authority to create a cluster object to cause a denial of service to MQ clustering. IBM Reference #: 1998647.CVE-2016-9737ibm corporationtririga application platform+1EPSS score0.54%
IBM TRIRIGA 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1996200.CVE-2016-9000ibm corporationinfosphere information server+2EPSS score1.15%
IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.CVE-2016-9005ibm corporationsystem storage+1EPSS score1.85%
IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system.CVE-2016-9994ibm corporationkenexa lcms premier on cloud+1EPSS score0.85%
IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM Reference #: 1976805.