Vulnerabilities > IBM > Medium

DATE CVE VULNERABILITY TITLE RISK
2016-09-26 CVE-2016-5970 Information Exposure vulnerability in IBM Security Privileged Identity Manager Virtual Appliance 2.0/2.0.2
Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files via a ..
network
low complexity
ibm CWE-200
6.5
2016-09-26 CVE-2016-5947 Improper Input Validation vulnerability in IBM products
IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to conduct clickjacking attacks via a crafted web site.
network
low complexity
ibm CWE-20
5.7
2016-09-26 CVE-2016-5946 Information Exposure vulnerability in IBM products
Directory traversal vulnerability in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to read arbitrary files via a ..
network
low complexity
ibm CWE-200
6.5
2016-09-26 CVE-2016-5945 Improper Access Control vulnerability in IBM products
IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to upload non-executable files via a crafted HTTP request.
network
low complexity
ibm CWE-284
4.3
2016-09-26 CVE-2016-5944 Cross-site Scripting vulnerability in IBM products
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string.
network
low complexity
ibm CWE-79
5.4
2016-09-26 CVE-2016-5943 Improper Access Control vulnerability in IBM Spectrum Control
IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to bypass intended access restrictions, and read task details or edit properties, via unspecified vectors.
network
low complexity
ibm CWE-284
5.4
2016-09-26 CVE-2016-3040 Open Redirect vulnerability in IBM Security Privileged Identity Manager Virtual Appliance 2.0
IBM WebSphere Application Server (WAS) Liberty, as used in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
network
low complexity
ibm CWE-601
6.8
2016-09-26 CVE-2016-3006 Cross-site Scripting vulnerability in IBM Connections
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3003.
network
low complexity
ibm CWE-79
5.4
2016-09-26 CVE-2016-3003 Cross-site Scripting vulnerability in IBM Connections
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3006.
network
low complexity
ibm CWE-79
5.4
2016-09-26 CVE-2016-3001 Cross-site Scripting vulnerability in IBM Connections
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3003 and CVE-2016-3006.
network
low complexity
ibm CWE-79
5.4