| CVE-2016-8963 | MEDIO5.5 | IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user. | 01/02/2017 |
| CVE-2016-8938 | CRITICO10.0 | IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host customer's production applications. | 01/02/2017 |
| CVE-2016-8933 | MEDIO6.5 | IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view arbitrary files on the system. | 01/02/2017 |
| CVE-2016-8932 | ALTO8.8 | IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server. | 01/02/2017 |
| CVE-2016-8931 | ALTO8.8 | IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server. | 01/02/2017 |
| CVE-2016-8930 | ALTO7.6 | IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. | 01/02/2017 |
| CVE-2016-8929 | MEDIO5.4 | IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. | 01/02/2017 |
| CVE-2016-8928 | ALTO7.6 | IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. | 01/02/2017 |
| CVE-2016-8919 | ALTO7.5 | IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources. | 01/02/2017 |
| CVE-2016-6115 | ALTO7.2 | IBM General Parallel File System is vulnerable to a buffer overflow. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system with root privileges or cause the server to crash. | 01/02/2017 |
| CVE-2016-6110 | MEDIO6.5 | IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user. | 01/02/2017 |
| CVE-2016-6068 | ALTO7.5 | IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties. | 01/02/2017 |
| CVE-2016-6001 | BASSO3.1 | IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing for some information disclosure of internal resources. | 01/02/2017 |
| CVE-2016-5953 | BASSO3.7 | IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL. | 01/02/2017 |
| CVE-2016-5942 | MEDIO5.4 | IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 01/02/2017 |
| CVE-2016-5941 | MEDIO5.7 | IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view arbitrary files on the system. | 01/02/2017 |
| CVE-2016-5940 | MEDIO5.4 | IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 01/02/2017 |
| CVE-2016-5938 | BASSO3.3 | IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system. | 01/02/2017 |
| CVE-2016-5881 | MEDIO6.1 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 01/02/2017 |
| CVE-2016-2992 | MEDIO5.4 | IBM Infosphere BigInsights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | 01/02/2017 |