# CVEs published 2017-02-01

143 CVEs were published on February 1, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-5630](https://cve.now/CVE-2017-5630.md): PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, (no CVSS, pear/pear)
- [CVE-2016-0217](https://cve.now/CVE-2016-0217.md): IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of us (no CVSS, IBM Cognos Business Intelligence)
- [CVE-2016-0218](https://cve.now/CVE-2016-0218.md): IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-supp (no CVSS, IBM Cognos Business Intelligence)
- [CVE-2016-0320](https://cve.now/CVE-2016-0320.md): IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users e (no CVSS, IBM UrbanCode Deploy)
- [CVE-2016-2924](https://cve.now/CVE-2016-2924.md): IBM Infosphere BigInsights is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. (no CVSS, IBM BigInsights)
- [CVE-2016-2941](https://cve.now/CVE-2016-2941.md): IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could b (no CVSS, IBM UrbanCode Deploy)
- [CVE-2016-2942](https://cve.now/CVE-2016-2942.md): IBM UrbanCode Deploy could allow an authenticated attacker with special permissions to craft a script on the server in a way that will cause (no CVSS, IBM UrbanCode Deploy)
- [CVE-2016-2992](https://cve.now/CVE-2016-2992.md): IBM Infosphere BigInsights is vulnerable to cross-site scripting. (no CVSS, IBM BigInsights)
- [CVE-2016-5881](https://cve.now/CVE-2016-5881.md): IBM iNotes is vulnerable to cross-site scripting. (no CVSS, IBM iNotes)
- [CVE-2016-5938](https://cve.now/CVE-2016-5938.md): IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-5940](https://cve.now/CVE-2016-5940.md): IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-5941](https://cve.now/CVE-2016-5941.md): IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-5942](https://cve.now/CVE-2016-5942.md): IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-5953](https://cve.now/CVE-2016-5953.md): IBM Sterling Order Management transmits the session identifier within the URL. (no CVSS, IBM Sterling Order Management)
- [CVE-2016-6001](https://cve.now/CVE-2016-6001.md): IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing for (no CVSS, IBM Forms Experience Builder)
- [CVE-2016-6068](https://cve.now/CVE-2016-6068.md): IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role prop (no CVSS, IBM UrbanCode Deploy)
- [CVE-2016-6110](https://cve.now/CVE-2016-6110.md): IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user. (no CVSS, IBM Tivoli Storage Manager)
- [CVE-2016-6115](https://cve.now/CVE-2016-6115.md): IBM General Parallel File System is vulnerable to a buffer overflow. (no CVSS, IBM Spectrum Scale)
- [CVE-2016-8919](https://cve.now/CVE-2016-8919.md): IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to r (no CVSS, IBM WebSphere Application Server)
- [CVE-2016-8928](https://cve.now/CVE-2016-8928.md): IBM Kenexa LMS on Cloud is vulnerable to SQL injection. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8929](https://cve.now/CVE-2016-8929.md): IBM Kenexa LMS on Cloud is vulnerable to SQL injection. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8930](https://cve.now/CVE-2016-8930.md): IBM Kenexa LMS on Cloud is vulnerable to SQL injection. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8931](https://cve.now/CVE-2016-8931.md): IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8932](https://cve.now/CVE-2016-8932.md): IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8933](https://cve.now/CVE-2016-8933.md): IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8938](https://cve.now/CVE-2016-8938.md): IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. (no CVSS, IBM UrbanCode Deploy)
- [CVE-2016-8963](https://cve.now/CVE-2016-8963.md): IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user. (no CVSS, IBM BigFix Inventory)
- [CVE-2016-8977](https://cve.now/CVE-2016-8977.md): IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. (no CVSS, IBM BigFix Inventory)
- [CVE-2016-8982](https://cve.now/CVE-2016-8982.md): IBM InfoSphere Information Server stores sensitive information in URL parameters. (no CVSS, IBM InfoSphere DataStage)
- [CVE-2016-8999](https://cve.now/CVE-2016-8999.md): IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks (no CVSS, IBM InfoSphere Information Server)
- [CVE-2016-9000](https://cve.now/CVE-2016-9000.md): IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. (no CVSS, IBM InfoSphere Information Server)
- [CVE-2016-9008](https://cve.now/CVE-2016-9008.md): IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent. (no CVSS, IBM UrbanCode Deploy)
- [CVE-2016-9703](https://cve.now/CVE-2016-9703.md): IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical acce (no CVSS, IBM Identity Manager)
- [CVE-2016-9704](https://cve.now/CVE-2016-9704.md): IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting. (no CVSS, IBM Identity Manager)
- [CVE-2016-9739](https://cve.now/CVE-2016-9739.md): IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user. (no CVSS, IBM Identity Manager)
- [CVE-2016-0371](https://cve.now/CVE-2016-0371.md): The Tivoli Storage Manager (TSM) password may be displayed in plain text via application trace output while application tracing is enabled. (no CVSS, IBM Tivoli Storage Manager)
- [CVE-2016-6105](https://cve.now/CVE-2016-6105.md): IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonym (no CVSS, IBM Key Lifecycle Manager)
- [CVE-2016-6117](https://cve.now/CVE-2016-6117.md): IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 can be deployed with active debugging code that can disclose sensitive information. (no CVSS, IBM Key Lifecycle Manager)
- [CVE-2016-8967](https://cve.now/CVE-2016-8967.md): IBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a local user. (no CVSS, IBM BigFix Inventory)
- [CVE-2016-0265](https://cve.now/CVE-2016-0265.md): IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. (no CVSS, IBM Campaign)
- [CVE-2016-0296](https://cve.now/CVE-2016-0296.md): IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available t (no CVSS, IBM BigFix Platform)
- [CVE-2016-0297](https://cve.now/CVE-2016-0297.md): IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing (no CVSS, IBM BigFix Platform)
- [CVE-2016-0394](https://cve.now/CVE-2016-0394.md): IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate ce (no CVSS, IBM Integration Bus)
- [CVE-2016-0396](https://cve.now/CVE-2016-0396.md): IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher (no CVSS, IBM BigFix Platform)
- [CVE-2016-2908](https://cve.now/CVE-2016-2908.md): IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error wh (no CVSS, IBM Access Manager)
- [CVE-2016-2938](https://cve.now/CVE-2016-2938.md): IBM iNotes is vulnerable to cross-site scripting. (no CVSS, IBM Domino 8.5.3.5, 8.5.3.6, 9.0.1, 8.5, 9.0, 8.5.1, 8.5.2,…)
- [CVE-2016-2939](https://cve.now/CVE-2016-2939.md): IBM iNotes is vulnerable to cross-site scripting. (no CVSS, IBM Domino)
- [CVE-2016-2987](https://cve.now/CVE-2016-2987.md): An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-3016](https://cve.now/CVE-2016-3016.md): IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integri (no CVSS, IBM Access Manager)
- [CVE-2016-3017](https://cve.now/CVE-2016-3017.md): IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations. (no CVSS, IBM Access Manager)
- [CVE-2016-3018](https://cve.now/CVE-2016-3018.md): IBM Security Access Manager for Web is vulnerable to cross-site scripting. (no CVSS, IBM Access Manager)
- [CVE-2016-3021](https://cve.now/CVE-2016-3021.md): IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a special (no CVSS, IBM Access Manager)
- [CVE-2016-3022](https://cve.now/CVE-2016-3022.md): IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file p (no CVSS, IBM Access Manager)
- [CVE-2016-3023](https://cve.now/CVE-2016-3023.md): IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file nam (no CVSS, IBM Access Manager)
- [CVE-2016-3024](https://cve.now/CVE-2016-3024.md): IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system. (no CVSS, IBM Access Manager)
- [CVE-2016-3027](https://cve.now/CVE-2016-3027.md): IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when proces (no CVSS, IBM Access Manager)
- [CVE-2016-3029](https://cve.now/CVE-2016-3029.md): IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unaut (no CVSS, IBM Access Manager)
- [CVE-2016-3034](https://cve.now/CVE-2016-3034.md): IBM AppScan Source uses a one-way hash without salt to encrypt highly sensitive information, which could allow a local attacker to decrypt i (no CVSS, IBM AppScan Source)
- [CVE-2016-3035](https://cve.now/CVE-2016-3035.md): IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server. (no CVSS, IBM AppScan Source)
- [CVE-2016-3043](https://cve.now/CVE-2016-3043.md): IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable (no CVSS, IBM Access Manager)
- [CVE-2016-3045](https://cve.now/CVE-2016-3045.md): IBM Security Access Manager for Web stores sensitive information in URL parameters. (no CVSS, IBM Access Manager)
- [CVE-2016-3046](https://cve.now/CVE-2016-3046.md): IBM Security Access Manager for Web is vulnerable to SQL injection. (no CVSS, IBM Access Manager)
- [CVE-2016-3053](https://cve.now/CVE-2016-3053.md): IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. (no CVSS, IBM AIX)
- [CVE-2016-5880](https://cve.now/CVE-2016-5880.md): IBM iNotes is vulnerable to cross-site scripting. (no CVSS, IBM Domino)
- [CVE-2016-5882](https://cve.now/CVE-2016-5882.md): IBM iNotes is vulnerable to cross-site scripting. (no CVSS, IBM Domino)
- [CVE-2016-5884](https://cve.now/CVE-2016-5884.md): IBM iNotes is vulnerable to cross-site scripting. (no CVSS, IBM Domino 8.5.3.5, 8.5.3.6, 9.0.1, 8.5, 9.0, 8.5.1, 8.5.2,…)
- [CVE-2016-5896](https://cve.now/CVE-2016-5896.md): IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser. (no CVSS, IBM Maximo Asset Management)
- [CVE-2016-5897](https://cve.now/CVE-2016-5897.md): IBM Jazz Reporting Service (JRS) is vulnerable to HTML injection. (no CVSS, IBM Jazz Reporting Service)
- [CVE-2016-5898](https://cve.now/CVE-2016-5898.md): IBM Jazz Reporting Service (JRS) could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization (no CVSS, IBM Jazz Reporting Service)
- [CVE-2016-5899](https://cve.now/CVE-2016-5899.md): IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. (no CVSS, IBM Jazz Reporting Service)
- [CVE-2016-5937](https://cve.now/CVE-2016-5937.md): IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthor (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2016-5939](https://cve.now/CVE-2016-5939.md): IBM Kenexa LMS on Cloud is vulnerable to SQL injection. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-5948](https://cve.now/CVE-2016-5948.md): IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2016-5949](https://cve.now/CVE-2016-5949.md): IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request. (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2016-5950](https://cve.now/CVE-2016-5950.md): IBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read by an authenticated user. (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2016-5951](https://cve.now/CVE-2016-5951.md): IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2016-5952](https://cve.now/CVE-2016-5952.md): IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2016-5958](https://cve.now/CVE-2016-5958.md): IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the sec (no CVSS, IBM Privileged Identity Manager)
- [CVE-2016-5964](https://cve.now/CVE-2016-5964.md): IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remot (no CVSS, IBM Privileged Identity Manager)
- [CVE-2016-5966](https://cve.now/CVE-2016-5966.md): IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the fail (no CVSS, IBM Privileged Identity Manager)
- [CVE-2016-5980](https://cve.now/CVE-2016-5980.md): IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. (no CVSS, IBM TRIRIGA Application Platform)
- [CVE-2016-5984](https://cve.now/CVE-2016-5984.md): IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. (no CVSS, IBM InfoSphere Information Server)
- [CVE-2016-5985](https://cve.now/CVE-2016-5985.md): The IBM Tivoli Storage Manager (IBM Spectrum Protect) AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. (no CVSS, IBM Tivoli Storage Manager)
- [CVE-2016-5988](https://cve.now/CVE-2016-5988.md): IBM Security Privileged Identity Manager Virtual Appliance could disclose sensitive information in generated error messages that would be av (no CVSS, IBM Privileged Identity Manager)
- [CVE-2016-5990](https://cve.now/CVE-2016-5990.md): IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automaticall (no CVSS, IBM Privileged Identity Manager)
- [CVE-2016-5994](https://cve.now/CVE-2016-5994.md): IBM InfoSphere Information Server contains a vulnerability that would allow an authenticated user to browse any file on the engine tier, and (no CVSS, IBM InfoSphere Information Server)
- [CVE-2016-6000](https://cve.now/CVE-2016-6000.md): IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. (no CVSS, IBM TRIRIGA Application Platform)
- [CVE-2016-6020](https://cve.now/CVE-2016-6020.md): IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM Sterling B2B Integrator)
- [CVE-2016-6028](https://cve.now/CVE-2016-6028.md): IBM Jazz technology based products might allow an attacker to view work item titles that they do not have privilege to view. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-6030](https://cve.now/CVE-2016-6030.md): IBM Jazz Foundation is vulnerable to cross-site scripting. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-6034](https://cve.now/CVE-2016-6034.md): IBM Tivoli Storage Manager for Virtual Environments (VMware) could disclose the Windows domain credentials to a user with a high level of pr (no CVSS, IBM Tivoli Storage Manager for Virtual Environments)
- [CVE-2016-6039](https://cve.now/CVE-2016-6039.md): IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. (no CVSS, IBM Jazz Reporting Service)
- [CVE-2016-6040](https://cve.now/CVE-2016-6040.md): IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-6042](https://cve.now/CVE-2016-6042.md): IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects (no CVSS, IBM AppScan Enterprise)
- [CVE-2016-6043](https://cve.now/CVE-2016-6043.md): Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not bei (no CVSS, IBM Tivoli Storage Manager Extended Edition)
- [CVE-2016-6044](https://cve.now/CVE-2016-6044.md): IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which ma (no CVSS, IBM Tivoli Storage Manager Extended Edition)
- [CVE-2016-6045](https://cve.now/CVE-2016-6045.md): IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious (no CVSS, IBM Tivoli Storage Manager Extended Edition)
- [CVE-2016-6046](https://cve.now/CVE-2016-6046.md): IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. (no CVSS, IBM Tivoli Storage Manager Extended Edition)
- [CVE-2016-6047](https://cve.now/CVE-2016-6047.md): IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. (no CVSS, IBM Jazz Reporting Service)
- [CVE-2016-6054](https://cve.now/CVE-2016-6054.md): IBM Jazz Foundation is vulnerable to cross-site scripting. (no CVSS, IBM Jazz Reporting Service)
- [CVE-2016-6059](https://cve.now/CVE-2016-6059.md): IBM InfoSphere Information Server is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processi (no CVSS, IBM InfoSphere Information Server)
- [CVE-2016-6061](https://cve.now/CVE-2016-6061.md): IBM Jazz Foundation is vulnerable to cross-site scripting. (no CVSS, IBM Rational Collaborative Lifecycle Management)
- [CVE-2016-6065](https://cve.now/CVE-2016-6065.md): IBM Security Guardium Database Activity Monitor appliance could allow a local user to inject commands that would be executed as root. (no CVSS, IBM Guardium)
- [CVE-2016-6072](https://cve.now/CVE-2016-6072.md): IBM Maximo Asset Management is vulnerable to cross-site scripting. (no CVSS, IBM Maximo Asset Management)
- [CVE-2016-6080](https://cve.now/CVE-2016-6080.md): The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker. (no CVSS, IBM WebSphere Message Broker)
- [CVE-2016-6082](https://cve.now/CVE-2016-6082.md): IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. (no CVSS, IBM BigFix Platform)
- [CVE-2016-6084](https://cve.now/CVE-2016-6084.md): IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema request. (no CVSS, IBM BigFix Platform)
- [CVE-2016-6085](https://cve.now/CVE-2016-6085.md): IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers. (no CVSS, IBM BigFix Platform)
- [CVE-2016-6090](https://cve.now/CVE-2016-6090.md): IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized a (no CVSS, IBM WebSphere Commerce Enterprise)
- [CVE-2016-6113](https://cve.now/CVE-2016-6113.md): IBM Verse is vulnerable to cross-site scripting. (no CVSS, IBM Domino)
- [CVE-2016-6122](https://cve.now/CVE-2016-6122.md): IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 discloses answers to security questions in a response to authenticated users. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-6123](https://cve.now/CVE-2016-6123.md): IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-6124](https://cve.now/CVE-2016-6124.md): IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to ex (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-6125](https://cve.now/CVE-2016-6125.md): IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-6126](https://cve.now/CVE-2016-6126.md): IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8911](https://cve.now/CVE-2016-8911.md): IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8912](https://cve.now/CVE-2016-8912.md): IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticat (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8913](https://cve.now/CVE-2016-8913.md): IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8918](https://cve.now/CVE-2016-8918.md): IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials. (no CVSS, IBM Integration Bus)
- [CVE-2016-8920](https://cve.now/CVE-2016-8920.md): IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. (no CVSS, IBM Kenexa LMS on Cloud)
- [CVE-2016-8921](https://cve.now/CVE-2016-8921.md): IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code o (no CVSS, IBM FileNet Content Manager)
- [CVE-2016-8922](https://cve.now/CVE-2016-8922.md): Exphox WebRadar is vulnerable to cross-site scripting. (no CVSS, IBM WebSphere Portal)
- [CVE-2016-8934](https://cve.now/CVE-2016-8934.md): IBM WebSphere Application Server is vulnerable to cross-site scripting. (no CVSS, IBM WebSphere Application Server for Bluemix)
- [CVE-2016-8936](https://cve.now/CVE-2016-8936.md): IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. (no CVSS, IBM WebSphere Portal)
- [CVE-2016-8941](https://cve.now/CVE-2016-8941.md): IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un (no CVSS, IBM Spectrum Control Standard Select Edition)
- [CVE-2016-8942](https://cve.now/CVE-2016-8942.md): IBM Tivoli Storage Productivity Center could allow an authenticated user with intimate knowledge of the system to edit a limited set of prop (no CVSS, IBM Spectrum Control Standard Select Edition)
- [CVE-2016-8943](https://cve.now/CVE-2016-8943.md): IBM Tivoli Storage Productivity Center is vulnerable to cross-site scripting. (no CVSS, IBM Spectrum Control Standard Select Edition)
- [CVE-2016-8961](https://cve.now/CVE-2016-8961.md): IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (no CVSS, IBM BigFix Inventory)
- [CVE-2016-8966](https://cve.now/CVE-2016-8966.md): IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict (no CVSS, IBM BigFix Inventory)
- [CVE-2016-8980](https://cve.now/CVE-2016-8980.md): IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML dat (no CVSS, IBM BigFix Inventory)
- [CVE-2016-8981](https://cve.now/CVE-2016-8981.md): IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system. (no CVSS, IBM BigFix Inventory)
- [CVE-2016-9731](https://cve.now/CVE-2016-9731.md): IBM Business Process Manager is vulnerable to cross-site scripting. (no CVSS, IBM Business Process Manager Advanced)
- [CVE-2016-10079](https://cve.now/CVE-2016-10079.md): SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long string to TCP port (no CVSS)
- [CVE-2016-9225](https://cve.now/CVE-2016-9225.md): A vulnerability in the data plane IP fragment handler of the Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security module could (no CVSS, all versions of the ASA CX Context-Aware Security module)
- [CVE-2017-3790](https://cve.now/CVE-2017-3790.md): A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software co (no CVSS, Cisco Expressway Series Software and Cisco TelePresence VCS…)
- [CVE-2017-3791](https://cve.now/CVE-2017-3791.md): A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execut (no CVSS, Cisco Prime Home versions from 6.3.0.0 to the first fixed r…)
- [CVE-2017-3792](https://cve.now/CVE-2017-3792.md): A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an una (no CVSS, Cisco TelePresence Multipoint Control Unit (MCU) software)
- [CVE-2016-8491](https://cve.now/CVE-2016-8491.md): The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote s (no CVSS, Fortinet FortiWLC)
- [CVE-2016-10164](https://cve.now/CVE-2016-10164.md): Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attack (no CVSS)
- [CVE-2016-10173](https://cve.now/CVE-2016-10173.md): Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to (no CVSS, archive-tar-minitar · minitar)
- [CVE-2016-4038](https://cve.now/CVE-2016-4038.md): Array index error in the msm\_sensor\_config function in kernel/SM-G9008V\_CHN\_KK\_Opensource/Kernel/drivers/media/platform/msm/camera\_v2/sensor (no CVSS)
- [CVE-2016-9963](https://cve.now/CVE-2016-9963.md): Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages. (no CVSS)
- [CVE-2017-3823](https://cve.now/CVE-2017-3823.md): An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on M (no CVSS, Cisco WebEx browser extensions)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-02-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.