deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-7421
Published: 2016-01-01
Description: Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2015-7420.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=isg3T1023277; http://www-01.ibm.com/support/docview.wss?uid=swg21971500; http://www.securityfocus.com/bid/82303
CVE: CVE-2015-7445
Published: 2016-01-01
Description: IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.x before 1.0.0.4, when guest access is configured, allow remote authenticated users to obtain sensitive information by reading error messages in responses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT12573; http://www-01.ibm.com/support/docview.wss?uid=swg21972480; http://www.securityfocus.com/bid/79681
CVE: CVE-2015-7409
Published: 2016-01-01
Description: Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.6 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21973175; http://www-01.ibm.com/support/docview.wss?uid=swg21973175
CVE: CVE-2015-7456
Published: 2016-01-01
Description: IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005476; http://www-01.ibm.com/support/docview.wss?uid=swg1IV79381; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005476
CVE: CVE-2015-4989
Published: 2016-01-02
Description: The portal in IBM Tealeaf Customer Experience before 8.7.1.8814, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary charts by specifying an internal chart name.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21968866; http://www-01.ibm.com/support/docview.wss?uid=swg21968866
CVE: CVE-2015-4990
Published: 2016-01-02
Description: The portal in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows local users to discover credentials by leveraging privileges during an unspecified connection type.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21969739; http://www-01.ibm.com/support/docview.wss?uid=swg21969739
CVE: CVE-2015-4996
Published: 2016-01-02
Description: IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972331; http://www.securitytracker.com/id/1034558; http://www-01.ibm.com/support/docview.wss?uid=swg21972331
CVE: CVE-2015-5018
Published: 2016-01-02
Description: IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute arbitrary OS commands by leveraging Local Management Interface (LMI) access.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV78768; http://www-01.ibm.com/support/docview.wss?uid=swg1IV78780; http://www-01.ibm.com/support/docview.wss?uid=swg21970510
CVE: CVE-2015-5020
Published: 2016-01-02
Description: The Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote authenticated users to bypass intended access restrictions and truncate arbitrary tables via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967923; http://www.securitytracker.com/id/1034561; http://www-01.ibm.com/support/docview.wss?uid=swg21967923
CVE: CVE-2015-7402
Published: 2016-01-02
Description: Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21970661; http://www-01.ibm.com/support/docview.wss?uid=swg21970661
CVE: CVE-2015-7429
Published: 2016-01-02
Description: The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 4.1 before 4.1.4 allows remote authenticated users to restore arbitrary virtual machines and consequently obtain sensitive information by visiting the vSphere inventory.
CVSS Score: 8.5 (HIGH)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21973087; http://www.securityfocus.com/bid/79541; http://www-01.ibm.com/support/docview.wss?uid=swg21973087
CVE: CVE-2015-7442
Published: 2016-01-02
Description: consoleinst.sh in IBM Installation Manager before 1.7.4.4 and 1.8.x before 1.8.4 and Packaging Utility before 1.7.4.4 and 1.8.x before 1.8.4 allows local users to gain privileges via a Trojan horse program that is located in /tmp with a name based on a predicted PID value.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21971295; http://www.securityfocus.com/bid/77558; http://www-01.ibm.com/support/docview.wss?uid=swg21971295
CVE: CVE-2015-7451
Published: 2016-01-02
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.9 IF2 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 IF2, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972423; http://www-01.ibm.com/support/docview.wss?uid=swg21972423
CVE: CVE-2015-1928
Published: 2016-01-02
Description: Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.x before 6.0.0 IF4; Rational Quality Manager (RQM) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.0 before 6.0.0 IF4; Rational Team Concert (RTC) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.0 before 6.0.0 IF4; Rational Requirements Composer (RRC) 3.x before 3.0.1.6 IF7 and 4.x before 4.0.7 IF9; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.0 before 6.0.0 IF4; Rational Engineering Lifecycle Manager (RELM) 4.0.3 through 4.0.7, 5.0 through 5.0.2, and 6.0.0; Rational Rhapsody Design Manager (DM) 4.0 through 4.0.7, 5.0 through 5.0.2, and 6.0.0; and Rational Software Architect Design Manager (DM) 4.0 through 4.0.7, 5.0 through 5.0.2, and 6.0.0 allows remote authenticated users to conduct clickjacking attacks via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21973200; http://www.securitytracker.com/id/1034565; http://www.securitytracker.com/id/1034566
CVE: CVE-2015-2023
Published: 2016-01-02
Description: Buffer overflow in IBM i Access 7.1 on Windows allows local users to gain privileges via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=nas8N1020996; http://www-01.ibm.com/support/docview.wss?uid=swg1SI57907; https://www.exploit-db.com/exploits/38751/
CVE: CVE-2015-7396
Published: 2016-01-02
Description: The Scheduler in IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.1 FP1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.1 FP1 for SmartCloud Control Desk allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or modify data, via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21970799; http://www-01.ibm.com/support/docview.wss?uid=swg21970799
CVE: CVE-2015-7400
Published: 2016-01-02
Description: The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 7.7 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT12268; http://www-01.ibm.com/support/docview.wss?uid=swg21970392; http://www.securityfocus.com/bid/77986
CVE: CVE-2015-7403
Published: 2016-01-02
Description: IBM Spectrum Scale 4.1.1.x before 4.1.1.3 and General Parallel File System (GPFS) 3.5.x before 3.5.0.29 and 4.1.x through 4.1.0.8 on AIX allow local users to cause a denial of service (incorrect pointer dereference and node crash) via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005452; http://www-01.ibm.com/support/docview.wss?uid=swg21972152; http://www.securityfocus.com/bid/79805
CVE: CVE-2015-7407
Published: 2016-01-02
Description: Cross-site request forgery (CSRF) vulnerability in Lotus Mashups in IBM Mashup Center 3.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT12268; http://www-01.ibm.com/support/docview.wss?uid=swg21970299; http://www.securityfocus.com/bid/78455
CVE: CVE-2015-7416
Published: 2016-01-02
Description: AFP Workbench Viewer in IBM i Access 7.1 on Windows allows remote attackers to cause a denial of service (viewer crash) via a crafted workbench file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=nas8N1020995; http://www-01.ibm.com/support/docview.wss?uid=swg1SI57907; http://www-01.ibm.com/support/docview.wss?uid=nas8N1020995
CVE: CVE-2015-7422
Published: 2016-01-02
Description: Buffer overflow in IBM i Access 7.1 on Windows allows local users to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=nas8N1020996; http://www-01.ibm.com/support/docview.wss?uid=swg1SI57907; http://www-01.ibm.com/support/docview.wss?uid=nas8N1020996
CVE: CVE-2015-7426
Published: 2016-01-02
Description: The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.3.0 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 4.1 before 4.1.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-78
References: http://www-01.ibm.com/support/docview.wss?uid=swg21971484; http://www-01.ibm.com/support/docview.wss?uid=swg21971484
CVE: CVE-2015-7430
Published: 2016-01-02
Description: The Hadoop connector 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and General Parallel File System (GPFS) allows local users to read or write to arbitrary GPFS data via unspecified vectors.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=isg3T1022979; http://www-01.ibm.com/support/docview.wss?uid=isg3T1022979
CVE: CVE-2015-7431
Published: 2016-01-02
Description: Cross-site scripting (XSS) vulnerability in Queue Watcher in IBM Sterling B2B Integrator 5.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT04830; http://www-01.ibm.com/support/docview.wss?uid=swg21970676; http://www-01.ibm.com/support/docview.wss?uid=swg1IT04830
CVE: CVE-2015-7435
Published: 2016-01-02
Description: IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 allows local users to bypass the Cognos Application Firewall (CAF) protection mechanism via leading whitespace in the BackURL field.
CVSS Score: 2.5 (LOW)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972799; http://www-01.ibm.com/support/docview.wss?uid=swg21972799
CVE: CVE-2015-7436
Published: 2016-01-02
Description: IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and 3.1.2.1 as used in Cognos Business Intelligence before 10.2.1.1 IF12 preserves user permissions across group-add and group-remove operations, which allows local users to bypass intended access restrictions in opportunistic circumstances by leveraging administrative changes to group membership.
CVSS Score: 2.5 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972799; http://www-01.ibm.com/support/docview.wss?uid=swg21972799
CVE: CVE-2015-7437
Published: 2016-01-02
Description: Queue Watcher in IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC99482; http://www-01.ibm.com/support/docview.wss?uid=swg21970927; http://www-01.ibm.com/support/docview.wss?uid=swg1IC99482
CVE: CVE-2015-7438
Published: 2016-01-02
Description: IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive cleartext web-services information by leveraging database access.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT09929; http://www-01.ibm.com/support/docview.wss?uid=swg21971012; http://www-01.ibm.com/support/docview.wss?uid=swg1IT09929
CVE: CVE-2015-7450
Published: 2016-01-02
Description: Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www-01.ibm.com/support/docview.wss?uid=swg21970575; http://www-01.ibm.com/support/docview.wss?uid=swg21971342; http://www-01.ibm.com/support/docview.wss?uid=swg21971376
CVE: CVE-2015-7452
Published: 2016-01-02
Description: IBM Maximo Asset Management 7.5 before 7.5.0.9 FP9 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 FP9, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allow remote authenticated users to obtain sensitive information via the REST API.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21972463; http://www-01.ibm.com/support/docview.wss?uid=swg21972463
CVE: CVE-2015-8027
Published: 2016-01-02
Description: Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://lists.opensuse.org/opensuse-updates/2016-01/msg00045.html; http://www-01.ibm.com/support/docview.wss?uid=swg1IV79524; http://www-01.ibm.com/support/docview.wss?uid=swg21972419
CVE: CVE-2015-1971
Published: 2016-01-03
Description: Unspecified vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF8 and 5.x before 5.0.2 IF10; Rational Quality Manager (RQM) 2.x and 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF8, and 5.x before 5.0.2 IF10; Rational Team Concert (RTC) 2.x and 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF8, and 5.x before 5.0.2 IF10; Rational Requirements Composer (RRC) 2.x and 3.x before 3.0.1.6 IF7 and 4.0 through 4.0.7; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF8 and 5.x before 5.0.2 IF10; Rational Engineering Lifecycle Manager (RELM) 1.0 through 1.0.0.1, 4.0.3 through 4.0.7, and 5.0 through 5.0.2; Rational Rhapsody Design Manager (DM) 3.0 through 3.0.1, 4.0 through 4.0.7, 5.0 through 5.0.2, and 6.0; and Rational Software Architect Design Manager (DM) 3.0 through 3.0.1, 4.0 through 4.0.7, and 5.0 through 5.0.2 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg21971164; http://www-01.ibm.com/support/docview.wss?uid=swg21971164
CVE: CVE-2015-1985
Published: 2016-01-03
Description: The queue manager on IBM MQ M2000 appliances before 8.0.0.4 allows local users to bypass an intended password requirement and read private keys by leveraging the existence of a stash file.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21971445; http://www-01.ibm.com/support/docview.wss?uid=swg21971445
CVE: CVE-2015-2007
Published: 2016-01-03
Description: Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967647; http://www-01.ibm.com/support/docview.wss?uid=swg21967647
CVE: CVE-2016-1283
Published: 2016-01-03
Description: The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178193.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178955.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html
CVE: CVE-2015-4946
Published: 2016-01-03
Description: Rational LifeCycle Project Administration in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Quality Manager (RQM) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Team Concert (RTC) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Requirements Composer (RRC) 3.x before 3.0.1.6 IF7 and 4.x before 4.0.7 IF9; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Engineering Lifecycle Manager (RELM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; Rational Rhapsody Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; and Rational Software Architect Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1 allows local users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21973404; http://www-01.ibm.com/support/docview.wss?uid=swg21973404
CVE: CVE-2015-4962
Published: 2016-01-03
Description: Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Quality Manager (RQM) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Team Concert (RTC) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Requirements Composer (RRC) 3.x before 3.0.1.6 IF7 and 4.x before 4.0.7 IF9; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Engineering Lifecycle Manager (RELM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; Rational Rhapsody Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; and Rational Software Architect Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1 uses weak permissions for unspecified project areas, which allows remote authenticated users to obtain sensitive information via unknown vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21973404; http://www-01.ibm.com/support/docview.wss?uid=swg21973404
CVE: CVE-2015-5003
Published: 2016-01-03
Description: The portal in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input.
CVSS Score: 8.5 (HIGH)
CWE: CWE-77
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV77742; http://www-01.ibm.com/support/docview.wss?uid=swg21970361; http://www.securitytracker.com/id/1034924
CVE: CVE-2015-5017
Published: 2016-01-03
Description: IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX005, and 7.6.0 before 7.6.0.2 IFIX002; Maximo Asset Management 7.5.0 before 7.5.0.8 IFIX005, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allow remote authenticated users to bypass intended access restrictions and establish a login session by entering an expired password.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21969052; http://www-01.ibm.com/support/docview.wss?uid=swg21969052
CVE: CVE-2015-5023
Published: 2016-01-03
Description: SQL injection vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21967851; http://www-01.ibm.com/support/docview.wss?uid=swg21967851
CVE: CVE-2015-5035
Published: 2016-01-03
Description: Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-5036.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO87020; http://www-01.ibm.com/support/docview.wss?uid=swg21971439; http://www-01.ibm.com/support/docview.wss?uid=swg1LO87020
CVE: CVE-2015-5036
Published: 2016-01-03
Description: Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-5035.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO87020; http://www-01.ibm.com/support/docview.wss?uid=swg21971439; http://www-01.ibm.com/support/docview.wss?uid=swg1LO87020