| CVE-2016-2866 | MEDIO4.3 | An unspecified vulnerability in IBM Jazz Team Server may disclose some deployment information to an authenticated user. | 08/02/2017 |
| CVE-2016-0270 | MEDIO5.9 | IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack." NOTE: this CVE | 08/02/2017 |
| CVE-2016-6104 | ALTO7.2 | IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute arbitrary code on the vulnerable system. | 07/02/2017 |
| CVE-2016-6097 | MEDIO4.0 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system. | 07/02/2017 |
| CVE-2016-6096 | MEDIO6.1 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 07/02/2017 |
| CVE-2016-6094 | MEDIO4.3 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or associated data. | 07/02/2017 |
| CVE-2016-6092 | MEDIO6.2 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user. | 07/02/2017 |
| CVE-2016-6116 | MEDIO5.9 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. | 02/02/2017 |
| CVE-2016-6103 | ALTO8.8 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | 02/02/2017 |
| CVE-2016-6099 | MEDIO5.3 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. | 02/02/2017 |
| CVE-2016-6095 | CRITICO9.8 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. | 02/02/2017 |
| CVE-2016-5935 | MEDIO5.9 | IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. | 02/02/2017 |
| CVE-2016-9739 | ALTO7.8 | IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user. | 01/02/2017 |
| CVE-2016-9704 | MEDIO6.1 | IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 01/02/2017 |
| CVE-2016-9703 | BASSO2.4 | IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information. | 01/02/2017 |
| CVE-2016-9008 | ALTO7.5 | IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent. | 01/02/2017 |
| CVE-2016-9000 | MEDIO6.1 | IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other clie | 01/02/2017 |
| CVE-2016-8999 | MEDIO5.4 | IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facilitating an attacker to inject malicious CSS. | 01/02/2017 |
| CVE-2016-8982 | MEDIO5.3 | IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. | 01/02/2017 |
| CVE-2016-8977 | MEDIO5.3 | IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the system. | 01/02/2017 |