Vulnerabilities > IBM > Qradar Security Information AND Event Manager > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-03-07 | CVE-2016-9726 | Improper Input Validation vulnerability in IBM products IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. | 8.8 |
| 2017-03-07 | CVE-2016-9724 | XXE vulnerability in IBM Qradar Security Information and Event Manager IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. | 8.1 |
| 2017-03-01 | CVE-2016-2880 | Key Management Errors vulnerability in IBM Qradar Security Information and Event Manager IBM QRadar 7.2 stores the encryption key used to encrypt the service account password which can be obtained by a local user. | 7.8 |
| 2017-03-01 | CVE-2016-2879 | Inadequate Encryption Strength vulnerability in IBM Qradar Security Information and Event Manager IBM QRadar 7.2 uses outdated hashing algorithms to hash certain passwords, which could allow a local user to obtain and decrypt user credentials. | 7.8 |
| 2016-11-30 | CVE-2016-2878 | Cross-Site Request Forgery (CSRF) vulnerability in IBM Qradar Security Information and Event Manager Multiple cross-site request forgery (CSRF) vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. | 8.0 |
| 2016-11-30 | CVE-2016-2876 | OS Command Injection vulnerability in IBM Qradar Security Information and Event Manager IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 executes unspecified processes at an incorrect privilege level, which makes it easier for remote authenticated users to obtain root access by leveraging a command-injection issue. | 7.5 |
| 2016-11-30 | CVE-2016-2873 | SQL Injection vulnerability in IBM Qradar Security Information and Event Manager SQL injection vulnerability in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | 8.8 |
| 2016-11-30 | CVE-2016-2871 | Credentials Management vulnerability in IBM Qradar Security Information and Event Manager IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive information by reading a configuration file. | 7.8 |
| 2016-08-08 | CVE-2016-2875 | Command Injection vulnerability in IBM Qradar Security Information and Event Manager IBM Security QRadar SIEM 7.1.x and 7.2.x before 7.2.7 allows remote authenticated users to execute arbitrary OS commands as root via unspecified vectors. | 8.8 |
| 2016-02-15 | CVE-2015-4956 | OS Command Injection vulnerability in IBM Qradar Security Information and Event Manager 7.1.0 The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands via unknown vectors. | 7.4 |