Vulnerabilities > IBM > Urbancode Deploy > Medium

DATE CVE VULNERABILITY TITLE RISK
2018-05-25 CVE-2017-1752 Information Exposure vulnerability in IBM Urbancode Deploy
IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information.
network
low complexity
ibm CWE-200
4.9
2018-01-09 CVE-2017-1493 Improper Privilege Management vulnerability in IBM Urbancode Deploy
IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls.
network
low complexity
ibm CWE-269
5.4
2017-03-08 CVE-2016-9006 Cross-site Scripting vulnerability in IBM Urbancode Deploy
IBM UrbanCode Deploy 6.1 and 6.2 is vulnerable to cross-site scripting.
network
low complexity
ibm CWE-79
5.4
2017-02-01 CVE-2016-2941 Information Exposure vulnerability in IBM Urbancode Deploy
IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could be read by a local user.
local
low complexity
ibm CWE-200
5.5
2017-02-01 CVE-2016-0320 Improper Access Control vulnerability in IBM Urbancode Deploy
IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users editing UCD objects.
network
low complexity
ibm CWE-284
4.3
2016-12-01 CVE-2016-2994 Cross-site Scripting vulnerability in IBM Urbancode Deploy
Cross-site scripting (XSS) vulnerability in IBM UrbanCode Deploy 6.2.x before 6.2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
network
low complexity
ibm CWE-79
5.4
2016-07-01 CVE-2016-0365 Information Exposure vulnerability in IBM Urbancode Deploy
IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1, when agent-relay Codestation artifact caching is enabled, allows remote attackers to bypass authentication and obtain sensitive artifact information via unspecified vectors.
network
high complexity
ibm CWE-200
5.9
2016-07-01 CVE-2016-0364 Information Exposure vulnerability in IBM Urbancode Deploy
IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure properties, which allows remote authenticated users to obtain sensitive information via vectors involving special characters.
network
low complexity
ibm CWE-200
4.3
2016-01-01 CVE-2015-7415 Cross-site Scripting vulnerability in IBM Urbancode Deploy
Multiple cross-site scripting (XSS) vulnerabilities in IBM UrbanCode Deploy 6.0 before 6.0.1.12, 6.1 before 6.1.3.2, and 6.2 before 6.2.0.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
network
low complexity
ibm CWE-79
5.4