IBM Corporation vulnerabilities, page 5
287 vulnerabilities
Known vulnerabilities in IBM Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 84 products.
CVE-2016-5888ibm corporationinteract+1
EPSS score0.51%
IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 115084.CVE-2016-5894ibm corporationwebsphere commerce enterprise+1EPSS score0.31%
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could view a plain text password in a Unix console. IBM Reference #: 1997408.CVE-2016-5898ibm corporationjazz reporting service+1EPSS score0.94%
IBM Jazz Reporting Service (JRS) could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a direct request, an attacker could exploit this vulnerability to obtain sensitive information.CVE-2016-5951ibm corporationkenexa lcms premier on cloud+1EPSS score0.54%
IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.CVE-2016-5952ibm corporationkenexa lcms premier on cloud+1EPSS score1.35%
IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.CVE-2016-5919ibm corporationaccess managerEPSS score0.69%
IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM Reference #: 1996868.CVE-2016-5900ibm corporationtealeaf customer experience+1EPSS score0.85%
IBM Tealeaf Customer Experience on Cloud Network Capture Add-On could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the TLS certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.CVE-2016-5940ibm corporationkenexa lms on cloud+1EPSS score0.54%
IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.CVE-2016-5988ibm corporationprivileged identity manager+1EPSS score0.99%
IBM Security Privileged Identity Manager Virtual Appliance could disclose sensitive information in generated error messages that would be available to an authenticated user.CVE-2016-5939ibm corporationkenexa lms on cloud+1EPSS score0.80%
IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.CVE-2016-5942ibm corporationkenexa lms on cloud+1EPSS score0.55%
IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.CVE-2016-5980ibm corporationtririga application platform+1EPSS score0.54%
IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.CVE-2016-5948ibm corporationkenexa lcms premier on cloud+1EPSS score0.54%
IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.CVE-2016-5918ibm corporationtivoli storage manager hsm for windows+1EPSS score0.30%
IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is prompt and the password is changed.CVE-2016-5881ibm corporationinotes+1EPSS score0.96%
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.CVE-2016-5897ibm corporationjazz reporting service+1EPSS score0.64%
IBM Jazz Reporting Service (JRS) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.CVE-2016-5937ibm corporationkenexa lcms premier on cloud+1EPSS score0.55%
IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.CVE-2016-5949ibm corporationkenexa lcms premier on cloud+1EPSS score1.28%
IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request.CVE-2016-5994ibm corporationinfosphere information server+1EPSS score1.17%
IBM InfoSphere Information Server contains a vulnerability that would allow an authenticated user to browse any file on the engine tier, and examine its contents.CVE-2016-5984ibm corporationinfosphere information server+2EPSS score0.85%
IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.