Vulnerabilities

DATE CVE VULNERABILITY TITLE RISK
2016-02-15 CVE-2015-5012 Cryptographic Issues vulnerability in IBM products
The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
network
low complexity
ibm CWE-310
7.5
2016-02-15 CVE-2015-5010 7PK - Security Features vulnerability in IBM products
IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
network
low complexity
ibm CWE-254
7.5
2016-02-15 CVE-2015-4991 Information Exposure vulnerability in IBM Spss Modeler
IBM SPSS Modeler 14.2 through FP3 IF027, 15 through FP3 IF015, 16 through FP2 IF012, 17 through FP1 IF018, and 17.1 through IF008 includes unspecified cleartext data in memory dumps, which allows local users to obtain sensitive information by reading a dump file.
local
low complexity
ibm CWE-200
4.0
2016-02-15 CVE-2015-4957 Cross-site Scripting vulnerability in IBM Qradar Security Information and Event Manager 7.1.0
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
network
low complexity
ibm CWE-79
5.4
2016-02-15 CVE-2015-4956 OS Command Injection vulnerability in IBM Qradar Security Information and Event Manager 7.1.0
The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands via unknown vectors.
network
low complexity
ibm CWE-78
7.4
2016-02-15 CVE-2015-3197 Information Exposure vulnerability in multiple products
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.
network
high complexity
oracle openssl CWE-200
5.9
2016-02-15 CVE-2015-2008 Improper Access Control vulnerability in IBM Qradar Security Information and Event Manager
IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.6 includes SSH private keys during backup operations, which allows remote authenticated administrators to obtain sensitive information by reading a backup archive.
network
high complexity
ibm CWE-284
4.4
2016-02-15 CVE-2015-2005 Information Exposure vulnerability in IBM Qradar Security Information and Event Manager
IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
network
low complexity
ibm CWE-200
5.3
2016-02-14 CVE-2016-1627 Permissions, Privileges, and Access Controls vulnerability in multiple products
The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL, related to browser/devtools/devtools_ui_bindings.cc and WebKit/Source/devtools/front_end/Runtime.js.
network
low complexity
opensuse debian google CWE-264
8.8
2016-02-14 CVE-2016-1626 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, miscalculates a certain layer index value, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.
network
low complexity
google opensuse debian CWE-119
4.3