CVE & Exploit Intelligence Database

CVE-2016-1566 5.4 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the file browser in Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location shared by multiple users, allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename. NOTE: this vulnerability was fixed in guacamole.war on 2016-01-13, but the version number was not changed.

CWE-79 Feb 02, 2017

CVE-2016-9704 6.1 MEDIUM EPSS 0.00

IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CWE-79 Feb 01, 2017

CVE-2016-9000 6.1 MEDIUM EPSS 0.00

IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.

CWE-79 Feb 01, 2017

CVE-2016-8999 5.4 MEDIUM EPSS 0.00

IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facilitating an attacker to inject malicious CSS.

CWE-79 Feb 01, 2017

CVE-2016-8982 5.3 MEDIUM EPSS 0.00

IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.

CWE-200 Feb 01, 2017

CVE-2016-8977 5.3 MEDIUM EPSS 0.00

IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the system.

CWE-200 Feb 01, 2017

CVE-2016-8963 5.5 MEDIUM EPSS 0.00

IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user.

CWE-200 Feb 01, 2017

CVE-2016-8933 6.5 MEDIUM EPSS 0.01

IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view arbitrary files on the system.

CWE-22 Feb 01, 2017

CVE-2016-8929 5.4 MEDIUM EPSS 0.00

IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

CWE-89 Feb 01, 2017

CVE-2016-6110 6.5 MEDIUM EPSS 0.00

IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user.

CWE-255 Feb 01, 2017

CVE-2016-5942 5.4 MEDIUM EPSS 0.00

IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CWE-79 Feb 01, 2017

CVE-2016-5941 5.7 MEDIUM EPSS 0.00

IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view arbitrary files on the system.

CWE-22 Feb 01, 2017

CVE-2016-5940 5.4 MEDIUM EPSS 0.00

IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CWE-79 Feb 01, 2017

CVE-2016-5881 6.1 MEDIUM EPSS 0.00

IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CWE-79 Feb 01, 2017

CVE-2016-2992 5.4 MEDIUM EPSS 0.00

IBM Infosphere BigInsights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CWE-79 Feb 01, 2017

CVE-2016-2941 5.5 MEDIUM EPSS 0.00

IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could be read by a local user.

CWE-200 Feb 01, 2017

CVE-2016-2924 5.4 MEDIUM EPSS 0.00

IBM Infosphere BigInsights is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CWE-79 Feb 01, 2017

CVE-2016-0320 4.3 MEDIUM EPSS 0.00

IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users editing UCD objects. This could affect the behavior of legitimately triggered processes.

CWE-284 Feb 01, 2017

CVE-2016-0218 5.4 MEDIUM EPSS 0.00

IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CWE-79 Feb 01, 2017

CVE-2016-0217 5.4 MEDIUM EPSS 0.00

IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CWE-79 Feb 01, 2017