Vulnerabilities > IBM > Qradar Security Information AND Event Manager > 7.2.0
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2016-07-02 | CVE-2016-2872 | Path Traversal vulnerability in IBM products Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.7 and QRadar Incident Forensics 7.2.x before 7.2.7 allows remote attackers to read arbitrary files via a crafted URL. | 5.0 |
2016-07-02 | CVE-2016-2868 | XML External Entity Information Disclosure vulnerability in IBM QRadar SIEM IBM Security QRadar SIEM 7.2.x before 7.2.7 allows remote authenticated administrators to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. | 4.0 |
2016-02-15 | CVE-2015-2008 | Improper Access Control vulnerability in IBM Qradar Security Information and Event Manager IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.6 includes SSH private keys during backup operations, which allows remote authenticated administrators to obtain sensitive information by reading a backup archive. | 3.5 |
2016-02-15 | CVE-2015-2005 | Information Exposure vulnerability in IBM Qradar Security Information and Event Manager IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation. | 5.0 |
2016-01-03 | CVE-2015-2007 | Path Traversal vulnerability in IBM Qradar Security Information and Event Manager Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafted URL. | 4.0 |
2016-01-01 | CVE-2015-7409 | Cross-site Scripting vulnerability in IBM Qradar Security Information and Event Manager Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.6 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified field. | 3.5 |
2015-11-08 | CVE-2015-5044 | Improper Input Validation vulnerability in IBM Qradar Security Information and Event Manager The Flow Collector in IBM Security QRadar QFLOW 7.1.x before 7.1 MR2 Patch 11 IF3 and 7.2.x before 7.2.5 Patch 4 IF3 allows remote attackers to cause a denial of service via unspecified packets. | 3.3 |
2015-10-04 | CVE-2015-4930 | Command Injection vulnerability in IBM Qradar Security Information and Event Manager IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access. | 9.0 |
2015-10-04 | CVE-2015-2016 | Command Execution vulnerability in IBM QRadar Security Information and Event Manager Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors. | 9.0 |
2015-10-04 | CVE-2015-2011 | Command Injection vulnerability in IBM Qradar Security Information and Event Manager The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors. | 9.0 |