Vulnerabilities > IBM > Medium

DATE CVE VULNERABILITY TITLE RISK
2016-02-15 CVE-2015-8531 Cross-site Scripting vulnerability in IBM products
Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
network
ibm CWE-79
4.3
2016-02-15 CVE-2015-7472 LDAP Injection vulnerability in IBM Webshphere Portal
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF10 allows remote attackers to conduct LDAP injection attacks, and consequently read or write to repository data, via unspecified vectors.
network
low complexity
ibm
6.4
2016-02-15 CVE-2015-7444 Information Exposure vulnerability in IBM Websphere Commerce 7.0.0.8/7.0.0.9
The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain sensitive information via unspecified vectors.
network
low complexity
ibm CWE-200
5.0
2016-02-15 CVE-2015-5050 Cross-Site Request Forgery (CSRF) vulnerability in IBM Emptoris Contract Management
Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
network
ibm CWE-352
6.8
2016-02-15 CVE-2015-5042 Improper Input Validation vulnerability in IBM Emptoris Contract Management
IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote attackers to execute arbitrary code by including a crafted Flash file.
network
low complexity
ibm CWE-20
5.0
2016-02-15 CVE-2015-5012 Cryptographic Issues vulnerability in IBM products
The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
network
low complexity
ibm CWE-310
5.0
2016-02-15 CVE-2015-5010 7PK - Security Features vulnerability in IBM products
IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
network
low complexity
ibm CWE-254
5.0
2016-02-15 CVE-2015-4956 OS Command Injection vulnerability in IBM Qradar Security Information and Event Manager 7.1.0
The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands via unknown vectors.
network
low complexity
ibm CWE-78
6.5
2016-02-15 CVE-2015-2005 Information Exposure vulnerability in IBM Qradar Security Information and Event Manager
IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.
network
low complexity
ibm CWE-200
5.0
2016-01-29 CVE-2015-7464 Denial of Service vulnerability in IBM Jazz Reporting Service
Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote attackers to cause a denial of service (Report Builder server outage) via a crafted request to a Report Builder instance URL.
network
low complexity
ibm
5.0