CVEs published February 1, 2017
143 CVEs were published on February 1, 2017: 0 critical, 0 high.
- Published
- 143
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 143
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM Kenexa LMS on Cloud
- 20
- IBM Access Manager
- 13
- IBM BigFix Inventory
- 7
- IBM BigFix Platform
- 6
- IBM Jazz Reporting Service
- 6
- IBM Kenexa LCMS Premier on Cloud
- 6
- IBM UrbanCode Deploy
- 6
- IBM InfoSphere Information Server
- 5
- IBM Privileged Identity Manager
- 5
- IBM Rational Collaborative Lifecycle Management
- 5
Medium, low and unrated 143
- CVE-2017-5630PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect,pear/pear
- CVE-2016-0217IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of usIBM Cognos Business Intelligence
- CVE-2016-0218IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-suppIBM Cognos Business Intelligence
- CVE-2016-0320IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users eIBM UrbanCode Deploy
- CVE-2016-2924IBM Infosphere BigInsights is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.IBM BigInsights
- CVE-2016-2941IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could bIBM UrbanCode Deploy
- CVE-2016-2942IBM UrbanCode Deploy could allow an authenticated attacker with special permissions to craft a script on the server in a way that will causeIBM UrbanCode Deploy
- CVE-2016-2992IBM Infosphere BigInsights is vulnerable to cross-site scripting.IBM BigInsights
- CVE-2016-5881IBM iNotes is vulnerable to cross-site scripting.IBM iNotes
- CVE-2016-5938IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system.IBM Kenexa LMS on Cloud
- CVE-2016-5940IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting.IBM Kenexa LMS on Cloud
- CVE-2016-5941IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system.IBM Kenexa LMS on Cloud
- CVE-2016-5942IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting.IBM Kenexa LMS on Cloud
- CVE-2016-5953IBM Sterling Order Management transmits the session identifier within the URL.IBM Sterling Order Management
- CVE-2016-6001IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing forIBM Forms Experience Builder
- CVE-2016-6068IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role propIBM UrbanCode Deploy
- CVE-2016-6110IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user.IBM Tivoli Storage Manager
- CVE-2016-6115IBM General Parallel File System is vulnerable to a buffer overflow.IBM Spectrum Scale
- CVE-2016-8919IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to rIBM WebSphere Application Server
- CVE-2016-8928IBM Kenexa LMS on Cloud is vulnerable to SQL injection.IBM Kenexa LMS on Cloud
- CVE-2016-8929IBM Kenexa LMS on Cloud is vulnerable to SQL injection.IBM Kenexa LMS on Cloud
- CVE-2016-8930IBM Kenexa LMS on Cloud is vulnerable to SQL injection.IBM Kenexa LMS on Cloud
- CVE-2016-8931IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code onIBM Kenexa LMS on Cloud
- CVE-2016-8932IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code onIBM Kenexa LMS on Cloud
- CVE-2016-8933IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system.IBM Kenexa LMS on Cloud
- CVE-2016-8938IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server.IBM UrbanCode Deploy
- CVE-2016-8963IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user.IBM BigFix Inventory
- CVE-2016-8977IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests.IBM BigFix Inventory
- CVE-2016-8982IBM InfoSphere Information Server stores sensitive information in URL parameters.IBM InfoSphere DataStage
- CVE-2016-8999IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks IBM InfoSphere Information Server
- CVE-2016-9000IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection.IBM InfoSphere Information Server
- CVE-2016-9008IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent.IBM UrbanCode Deploy
- CVE-2016-9703IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical acceIBM Identity Manager
- CVE-2016-9704IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting.IBM Identity Manager
- CVE-2016-9739IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user.IBM Identity Manager
- CVE-2016-0371The Tivoli Storage Manager (TSM) password may be displayed in plain text via application trace output while application tracing is enabled.IBM Tivoli Storage Manager
- CVE-2016-6105IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonymIBM Key Lifecycle Manager
- CVE-2016-6117IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 can be deployed with active debugging code that can disclose sensitive information.IBM Key Lifecycle Manager
- CVE-2016-8967IBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a local user.IBM BigFix Inventory
- CVE-2016-0265IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.IBM Campaign
- CVE-2016-0296IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available tIBM BigFix Platform
- CVE-2016-0297IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing IBM BigFix Platform
- CVE-2016-0394IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate ceIBM Integration Bus
- CVE-2016-0396IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higherIBM BigFix Platform
- CVE-2016-2908IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error whIBM Access Manager
- CVE-2016-2938IBM iNotes is vulnerable to cross-site scripting.IBM Domino 8.5.3.5, 8.5.3.6, 9.0.1, 8.5, 9.0, 8.5.1, 8.5.2,…
- CVE-2016-2939IBM iNotes is vulnerable to cross-site scripting.IBM Domino
- CVE-2016-2987An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker.IBM Rational Collaborative Lifecycle Management
- CVE-2016-3016IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integriIBM Access Manager
- CVE-2016-3017IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations.IBM Access Manager
- CVE-2016-3018IBM Security Access Manager for Web is vulnerable to cross-site scripting.IBM Access Manager
- CVE-2016-3021IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specialIBM Access Manager
- CVE-2016-3022IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file pIBM Access Manager
- CVE-2016-3023IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file namIBM Access Manager
- CVE-2016-3024IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system.IBM Access Manager
- CVE-2016-3027IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when procesIBM Access Manager
- CVE-2016-3029IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unautIBM Access Manager
- CVE-2016-3034IBM AppScan Source uses a one-way hash without salt to encrypt highly sensitive information, which could allow a local attacker to decrypt iIBM AppScan Source
- CVE-2016-3035IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server.IBM AppScan Source
- CVE-2016-3043IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable IBM Access Manager
- CVE-2016-3045IBM Security Access Manager for Web stores sensitive information in URL parameters.IBM Access Manager
- CVE-2016-3046IBM Security Access Manager for Web is vulnerable to SQL injection.IBM Access Manager
- CVE-2016-3053IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges.IBM AIX
- CVE-2016-5880IBM iNotes is vulnerable to cross-site scripting.IBM Domino
- CVE-2016-5882IBM iNotes is vulnerable to cross-site scripting.IBM Domino
- CVE-2016-5884IBM iNotes is vulnerable to cross-site scripting.IBM Domino 8.5.3.5, 8.5.3.6, 9.0.1, 8.5, 9.0, 8.5.1, 8.5.2,…
- CVE-2016-5896IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser.IBM Maximo Asset Management
- CVE-2016-5897IBM Jazz Reporting Service (JRS) is vulnerable to HTML injection.IBM Jazz Reporting Service
- CVE-2016-5898IBM Jazz Reporting Service (JRS) could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serializationIBM Jazz Reporting Service
- CVE-2016-5899IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2016-5937IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorIBM Kenexa LCMS Premier on Cloud
- CVE-2016-5939IBM Kenexa LMS on Cloud is vulnerable to SQL injection.IBM Kenexa LMS on Cloud
- CVE-2016-5948IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting.IBM Kenexa LCMS Premier on Cloud
- CVE-2016-5949IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request.IBM Kenexa LCMS Premier on Cloud
- CVE-2016-5950IBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read by an authenticated user.IBM Kenexa LCMS Premier on Cloud
- CVE-2016-5951IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting.IBM Kenexa LCMS Premier on Cloud
- CVE-2016-5952IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection.IBM Kenexa LCMS Premier on Cloud
- CVE-2016-5958IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secIBM Privileged Identity Manager
- CVE-2016-5964IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remotIBM Privileged Identity Manager
- CVE-2016-5966IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failIBM Privileged Identity Manager
- CVE-2016-5980IBM TRIRIGA Application Platform is vulnerable to cross-site scripting.IBM TRIRIGA Application Platform
- CVE-2016-5984IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection.IBM InfoSphere Information Server
- CVE-2016-5985The IBM Tivoli Storage Manager (IBM Spectrum Protect) AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled.IBM Tivoli Storage Manager
- CVE-2016-5988IBM Security Privileged Identity Manager Virtual Appliance could disclose sensitive information in generated error messages that would be avIBM Privileged Identity Manager
- CVE-2016-5990IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automaticallIBM Privileged Identity Manager
- CVE-2016-5994IBM InfoSphere Information Server contains a vulnerability that would allow an authenticated user to browse any file on the engine tier, andIBM InfoSphere Information Server
- CVE-2016-6000IBM TRIRIGA Application Platform is vulnerable to cross-site scripting.IBM TRIRIGA Application Platform
- CVE-2016-6020IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Sterling B2B Integrator
- CVE-2016-6028IBM Jazz technology based products might allow an attacker to view work item titles that they do not have privilege to view.IBM Rational Collaborative Lifecycle Management
- CVE-2016-6030IBM Jazz Foundation is vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management
- CVE-2016-6034IBM Tivoli Storage Manager for Virtual Environments (VMware) could disclose the Windows domain credentials to a user with a high level of prIBM Tivoli Storage Manager for Virtual Environments
- CVE-2016-6039IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2016-6040IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced.IBM Rational Collaborative Lifecycle Management
- CVE-2016-6042IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objectsIBM AppScan Enterprise
- CVE-2016-6043Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not beiIBM Tivoli Storage Manager Extended Edition
- CVE-2016-6044IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which maIBM Tivoli Storage Manager Extended Edition
- CVE-2016-6045IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious IBM Tivoli Storage Manager Extended Edition
- CVE-2016-6046IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting.IBM Tivoli Storage Manager Extended Edition
- CVE-2016-6047IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2016-6054IBM Jazz Foundation is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2016-6059IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processiIBM InfoSphere Information Server
- CVE-2016-6061IBM Jazz Foundation is vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management
- CVE-2016-6065IBM Security Guardium Database Activity Monitor appliance could allow a local user to inject commands that would be executed as root.IBM Guardium
- CVE-2016-6072IBM Maximo Asset Management is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2016-6080The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker.IBM WebSphere Message Broker
- CVE-2016-6082IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition.IBM BigFix Platform
- CVE-2016-6084IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema request.IBM BigFix Platform
- CVE-2016-6085IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers.IBM BigFix Platform
- CVE-2016-6090IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized aIBM WebSphere Commerce Enterprise
- CVE-2016-6113IBM Verse is vulnerable to cross-site scripting.IBM Domino
- CVE-2016-6122IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 discloses answers to security questions in a response to authenticated users.IBM Kenexa LMS on Cloud
- CVE-2016-6123IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting.IBM Kenexa LMS on Cloud
- CVE-2016-6124IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to exIBM Kenexa LMS on Cloud
- CVE-2016-6125IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting.IBM Kenexa LMS on Cloud
- CVE-2016-6126IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system.IBM Kenexa LMS on Cloud
- CVE-2016-8911IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim.IBM Kenexa LMS on Cloud
- CVE-2016-8912IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticatIBM Kenexa LMS on Cloud
- CVE-2016-8913IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system.IBM Kenexa LMS on Cloud
- CVE-2016-8918IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials.IBM Integration Bus
- CVE-2016-8920IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting.IBM Kenexa LMS on Cloud
- CVE-2016-8921IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code oIBM FileNet Content Manager
- CVE-2016-8922Exphox WebRadar is vulnerable to cross-site scripting.IBM WebSphere Portal
- CVE-2016-8934IBM WebSphere Application Server is vulnerable to cross-site scripting.IBM WebSphere Application Server for Bluemix
- CVE-2016-8936IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting.IBM WebSphere Portal
- CVE-2016-8941IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unIBM Spectrum Control Standard Select Edition
- CVE-2016-8942IBM Tivoli Storage Productivity Center could allow an authenticated user with intimate knowledge of the system to edit a limited set of propIBM Spectrum Control Standard Select Edition
- CVE-2016-8943IBM Tivoli Storage Productivity Center is vulnerable to cross-site scripting.IBM Spectrum Control Standard Select Edition
- CVE-2016-8961IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM BigFix Inventory
- CVE-2016-8966IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict IBM BigFix Inventory
- CVE-2016-8980IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML datIBM BigFix Inventory
- CVE-2016-8981IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system.IBM BigFix Inventory
- CVE-2016-9731IBM Business Process Manager is vulnerable to cross-site scripting.IBM Business Process Manager Advanced
- CVE-2016-10079SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long string to TCP port
- CVE-2016-9225A vulnerability in the data plane IP fragment handler of the Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security module could all versions of the ASA CX Context-Aware Security module
- CVE-2017-3790A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software coCisco Expressway Series Software and Cisco TelePresence VCS…
- CVE-2017-3791A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and executCisco Prime Home versions from 6.3.0.0 to the first fixed r…
- CVE-2017-3792A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unaCisco TelePresence Multipoint Control Unit (MCU) software
- CVE-2016-8491The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote sFortinet FortiWLC
- CVE-2016-10164Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attack
- CVE-2016-10173Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to archive-tar-minitar · minitar
- CVE-2016-4038Array index error in the msm_sensor_config function in kernel/SM-G9008V_CHN_KK_Opensource/Kernel/drivers/media/platform/msm/camera_v2/sensor
- CVE-2016-9963Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.
- CVE-2017-3823An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on MCisco WebEx browser extensions