Vulnerabilities > IBM > Medium

DATE CVE VULNERABILITY TITLE RISK
2017-02-08 CVE-2015-5013 Insufficiently Protected Credentials vulnerability in IBM products
The IBM Security Access Manager appliance includes configuration files that contain obfuscated plaintext-passwords which authenticated users can access.
local
low complexity
ibm CWE-522
5.5
2017-02-08 CVE-2016-0270 Information Exposure vulnerability in IBM Client Application Access, Domino and Notes
IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack." NOTE: this CVE has been incorrectly used for GCM nonce reuse issues in other products; see CVE-2016-10213 for the A10 issue, CVE-2016-10212 for the Radware issue, and CVE-2017-5933 for the Citrix issue.
network
high complexity
ibm CWE-200
5.9
2017-02-07 CVE-2016-6097 Information Exposure vulnerability in IBM products
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system.
local
low complexity
ibm CWE-200
4.0
2017-02-07 CVE-2016-6096 Cross-site Scripting vulnerability in IBM products
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting.
network
low complexity
ibm CWE-79
6.1
2017-02-07 CVE-2016-6094 Information Exposure vulnerability in IBM products
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or associated data.
network
low complexity
ibm CWE-200
4.3
2017-02-07 CVE-2016-6092 Information Exposure vulnerability in IBM products
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user.
local
low complexity
ibm CWE-200
6.2
2017-02-07 CVE-2016-3020 Improper Access Control vulnerability in IBM products
IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictions, caused by improper content validation.
local
low complexity
ibm CWE-284
5.5
2017-02-02 CVE-2016-6116 Information Exposure vulnerability in IBM Security KEY Lifecycle Manager
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security.
network
high complexity
ibm CWE-200
5.9
2017-02-02 CVE-2016-6099 Information Exposure vulnerability in IBM Security KEY Lifecycle Manager
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users.
network
low complexity
ibm CWE-200
5.3
2017-02-02 CVE-2016-5935 Information Exposure vulnerability in IBM Dashboard Application Services HUB 3.1.3
IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate.
network
high complexity
ibm CWE-200
5.9