deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4760
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attacks against non-HTTP Safari sessions by leveraging HTTP/0.9 support.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html
CVE: CVE-2016-4762
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, iCloud before 6.0 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html
CVE: CVE-2016-4763
Published: 2016-09-25
Description: WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html
CVE: CVE-2016-4765
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4766, CVE-2016-4767, and CVE-2016-4768.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE: CVE-2016-4766
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4767, and CVE-2016-4768.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE: CVE-2016-4767
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4766, and CVE-2016-4768.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE: CVE-2016-4768
Published: 2016-09-25
Description: WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4766, and CVE-2016-4767.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE: CVE-2016-4769
Published: 2016-09-25
Description: WebKit in Apple iTunes before 12.5.1 on Windows and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html; http://www.securityfocus.com/bid/93062
CVE: CVE-2016-4771
Published: 2016-09-25
Description: The kernel in Apple iOS before 10 and OS X before 10.12 allows local users to bypass intended file-access restrictions via a crafted directory pathname.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://www.securityfocus.com/bid/93056
CVE: CVE-2016-4772
Published: 2016-09-25
Description: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to cause a denial of service (unintended lock) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4773
Published: 2016-09-25
Description: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app, a different vulnerability than CVE-2016-4774 and CVE-2016-4776.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4774
Published: 2016-09-25
Description: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app, a different vulnerability than CVE-2016-4773 and CVE-2016-4776.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4775
Published: 2016-09-25
Description: The kernel in Apple OS X before 10.12, tvOS before 10, and watchOS before 3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html
CVE: CVE-2016-4776
Published: 2016-09-25
Description: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app, a different vulnerability than CVE-2016-4773 and CVE-2016-4774.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4777
Published: 2016-09-25
Description: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (invalid pointer dereference) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264, CWE-476
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4778
Published: 2016-09-25
Description: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html; http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html
CVE: CVE-2016-4779
Published: 2016-09-25
Description: Apple Type Services (ATS) in Apple OS X before 10.12 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://www.securityfocus.com/bid/93055; http://www.securitytracker.com/id/1036858
CVE: CVE-2016-5169
Published: 2016-09-25
Description: Format string vulnerability in Google Chrome OS before 53.0.2785.103 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/92914; https://bugs.chromium.org/p/chromium/issues/detail?id=635879; https://googlechromereleases.blogspot.com/2016/09/stable-channel-update-for-chrome-os_9.html
CVE: CVE-2016-5170
Published: 2016-09-25
Description: WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not properly consider getter side effects during array key conversion, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Indexed Database (aka IndexedDB) API calls.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2016-1905.html; http://www.debian.org/security/2016/dsa-3667; http://www.securityfocus.com/bid/92942
CVE: CVE-2016-5171
Published: 2016-09-25
Description: WebKit/Source/bindings/templates/interface.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not prevent certain constructor calls, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://rhn.redhat.com/errata/RHSA-2016-1905.html; http://www.debian.org/security/2016/dsa-3667; http://www.securityfocus.com/bid/92942
CVE: CVE-2016-5172
Published: 2016-09-25
Description: The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-1905.html; http://www.debian.org/security/2016/dsa-3667; http://www.securityfocus.com/bid/92942
CVE: CVE-2016-5173
Published: 2016-09-25
Description: The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-284
References: http://rhn.redhat.com/errata/RHSA-2016-1905.html; http://www.debian.org/security/2016/dsa-3667; http://www.securityfocus.com/bid/92942
CVE: CVE-2016-5174
Published: 2016-09-25
Description: browser/ui/cocoa/browser_window_controller_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests during a fullscreen transition, which allows remote attackers to cause a denial of service (unsuppressed popup) via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-1905.html; http://www.debian.org/security/2016/dsa-3667; http://www.securityfocus.com/bid/92942
CVE: CVE-2016-5175
Published: 2016-09-25
Description: Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.113 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 8.8 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2016-1905.html; http://www.debian.org/security/2016/dsa-3667; http://www.securityfocus.com/bid/92942
CVE: CVE-2016-7549
Published: 2016-09-25
Description: Google Chrome before 53.0.2785.113 does not ensure that the recipient of a certain IPC message is a valid RenderFrame or RenderWidget, which allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) or possibly have unspecified other impact by leveraging access to a renderer process, related to render_frame_host_impl.cc and render_widget_host_impl.cc, as demonstrated by a Password Manager message.
CVSS Score: 8.8 (HIGH)
References: http://rhn.redhat.com/errata/RHSA-2016-1905.html; http://www.securityfocus.com/bid/93160; https://codereview.chromium.org/[PII_REDACTED]
CVE: CVE-2016-0248
Published: 2016-09-26
Description: IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions via unspecified vectors.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21982031; http://www.securityfocus.com/bid/93137; http://www-01.ibm.com/support/docview.wss?uid=swg21982031
CVE: CVE-2016-0379
Published: 2016-09-26
Description: IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated users to cause a denial of service (channel outage) by leveraging queue-manager rights.
CVSS Score: 3.1 (LOW)
CWE: CWE-19
References: http://www-01.ibm.com/support/docview.wss?uid=swg21984565; http://www.securityfocus.com/bid/93146; http://www-01.ibm.com/support/docview.wss?uid=swg21984565
CVE: CVE-2016-2999
Published: 2016-09-26
Description: IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sensitive information via an unspecified brute-force attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO89962; http://www.securityfocus.com/bid/93147; https://www-01.ibm.com/support/docview.wss?uid=swg21989067
CVE: CVE-2016-3000
Published: 2016-09-26
Description: The help service in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to cause a denial of service (service degradation) via a crafted URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO89962; http://www.securityfocus.com/bid/93166; https://www-01.ibm.com/support/docview.wss?uid=swg21989067
CVE: CVE-2016-3001
Published: 2016-09-26
Description: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3003 and CVE-2016-3006.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO89962; http://www.securityfocus.com/bid/93172; https://www-01.ibm.com/support/docview.wss?uid=swg21989067
CVE: CVE-2016-3003
Published: 2016-09-26
Description: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3006.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO89962; http://www.securityfocus.com/bid/93161; https://www-01.ibm.com/support/docview.wss?uid=swg21989067
CVE: CVE-2016-3006
Published: 2016-09-26
Description: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3003.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO89962; http://www.securityfocus.com/bid/93167; https://www-01.ibm.com/support/docview.wss?uid=swg21989067
CVE: CVE-2016-3007
Published: 2016-09-26
Description: Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack the authentication of arbitrary users.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO89962; http://www.securityfocus.com/bid/93168; https://www-01.ibm.com/support/docview.wss?uid=swg21989067
CVE: CVE-2016-3040
Published: 2016-09-26
Description: IBM WebSphere Application Server (WAS) Liberty, as used in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-601
References: http://www-01.ibm.com/support/docview.wss?uid=swg21989205; http://www.securityfocus.com/bid/92986; http://www-01.ibm.com/support/docview.wss?uid=swg21989205
CVE: CVE-2016-5943
Published: 2016-09-26
Description: IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to bypass intended access restrictions, and read task details or edit properties, via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT16944; http://www-01.ibm.com/support/docview.wss?uid=swg21988625; http://www.securityfocus.com/bid/93084
CVE: CVE-2016-5944
Published: 2016-09-26
Description: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT16944; http://www-01.ibm.com/support/docview.wss?uid=swg21988625; http://www.securityfocus.com/bid/93087
CVE: CVE-2016-5945
Published: 2016-09-26
Description: IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to upload non-executable files via a crafted HTTP request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT16944; http://www-01.ibm.com/support/docview.wss?uid=swg21988625; http://www.securityfocus.com/bid/93082
CVE: CVE-2016-5946
Published: 2016-09-26
Description: Directory traversal vulnerability in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT16944; http://www-01.ibm.com/support/docview.wss?uid=swg21988625; http://www.securityfocus.com/bid/93086
CVE: CVE-2016-5947
Published: 2016-09-26
Description: IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to conduct clickjacking attacks via a crafted web site.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT16944; http://www-01.ibm.com/support/docview.wss?uid=swg21988625; http://www.securityfocus.com/bid/93085
CVE: CVE-2016-5957
Published: 2016-09-26
Description: IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive information by leveraging a weak algorithm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21989205; http://www.securityfocus.com/bid/93083; http://www-01.ibm.com/support/docview.wss?uid=swg21989205
CVE: CVE-2016-5963
Published: 2016-09-26
Description: IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 does not properly validate updates, which allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21989205; http://www.securityfocus.com/bid/93076; http://www-01.ibm.com/support/docview.wss?uid=swg21989205
CVE: CVE-2016-5970
Published: 2016-09-26
Description: Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21989205; http://www.securityfocus.com/bid/93080; http://www-01.ibm.com/support/docview.wss?uid=swg21989205
CVE: CVE-2016-5971
Published: 2016-09-26
Description: IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200, CWE-611
References: http://www-01.ibm.com/support/docview.wss?uid=swg21989205; http://www.securityfocus.com/bid/93081; http://www-01.ibm.com/support/docview.wss?uid=swg21989205
CVE: CVE-2016-5972
Published: 2016-09-26
Description: IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 uses weak permissions for unspecified resources, which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200, CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21989205; http://www.securityfocus.com/bid/93077; http://www-01.ibm.com/support/docview.wss?uid=swg21989205
CVE: CVE-2016-5974
Published: 2016-09-26
Description: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21989205; http://www-01.ibm.com/support/docview.wss?uid=swg21989205
CVE: CVE-2016-5975
Published: 2016-09-26
Description: Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224_9.0.2A FP3 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-5978.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21990216; http://www.securityfocus.com/bid/93135; http://www-01.ibm.com/support/docview.wss?uid=swg21990216