deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-9406
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9407
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9408
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving editing users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9409
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9410
Published: 2017-01-31
Description: MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9411
Published: 2017-01-31
Description: The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9412
Published: 2017-01-31
Description: MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9413
Published: 2017-01-31
Description: The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9414
Published: 2017-01-31
Description: MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94395
CVE: CVE-2016-9415
Published: 2017-01-31
Description: MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94396
CVE: CVE-2016-9416
Published: 2017-01-31
Description: SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94396
CVE: CVE-2016-9417
Published: 2017-01-31
Description: The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
CVSS Score: 7.4 (HIGH)
CWE: CWE-918
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94396
CVE: CVE-2016-9418
Published: 2017-01-31
Description: MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94396
CVE: CVE-2016-9419
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94396
CVE: CVE-2016-9420
Published: 2017-01-31
Description: MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94396
CVE: CVE-2016-9421
Published: 2017-01-31
Description: Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/11/10/8; http://www.openwall.com/lists/oss-security/2016/11/18/1; http://www.securityfocus.com/bid/94396
CVE: CVE-2016-9962
Published: 2017-01-31
Description: RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container.  This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: http://rhn.redhat.com/errata/RHSA-2017-0116.html; http://rhn.redhat.com/errata/RHSA-2017-0123.html; http://rhn.redhat.com/errata/RHSA-2017-0127.html
CVE: CVE-2017-3823
Published: 2017-02-01
Description: An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin before 2.1.0.10 on Internet Explorer. A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows. The vulnerability is a design defect in an application programing interface (API) response parser within the extension. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/95737; http://www.securitytracker.com/id/1037680; https://0patch.blogspot.com/2017/01/micropatching-remote-code-execution-in.html
CVE: CVE-2016-10164
Published: 2017-02-01
Description: Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-190, CWE-787
References: http://www.debian.org/security/2017/dsa-3772; http://www.openwall.com/lists/oss-security/2017/01/22/2; http://www.openwall.com/lists/oss-security/2017/01/25/7
CVE: CVE-2016-10173
Published: 2017-02-01
Description: Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.debian.org/security/2017/dsa-3778; http://www.openwall.com/lists/oss-security/2017/01/24/7; http://www.openwall.com/lists/oss-security/2017/01/29/1
CVE: CVE-2016-4038
Published: 2017-02-01
Description: Array index error in the msm_sensor_config function in kernel/SM-G9008V_CHN_KK_Opensource/Kernel/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c in Samsung devices with Android KK(4.4) or L and an APQ8084, MSM8974, or MSM8974pro chipset allows local users to have unspecified impact via the gpio_config.gpio_name value.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2016; http://www.openwall.com/lists/oss-security/2016/04/17/2; http://www.openwall.com/lists/oss-security/2016/04/18/8
CVE: CVE-2016-9963
Published: 2017-02-01
Description: Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-320
References: http://www.debian.org/security/2016/dsa-3747; http://www.exim.org/static/doc/CVE-2016-9963.txt; http://www.securityfocus.com/bid/94947
CVE: CVE-2016-8491
Published: 2017-02-01
Description: The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: http://www.securityfocus.com/bid/94186; https://fortiguard.com/advisory/FG-IR-16-065; http://www.securityfocus.com/bid/94186
CVE: CVE-2016-10079
Published: 2017-02-01
Description: SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long string to TCP port 515.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.exploit-db.com/exploits/41030/; https://www.exploit-db.com/exploits/41030/
CVE: CVE-2016-9225
Published: 2017-02-01
Description: A vulnerability in the data plane IP fragment handler of the Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security module could allow an unauthenticated, remote attacker to cause the CX module to be unable to process further traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of IP fragments. An attacker could exploit this vulnerability by sending crafted fragmented IP traffic across the CX module. An exploit could allow the attacker to exhaust free packet buffers in shared memory (SHM), causing the CX module to be unable to process further traffic, resulting in a DoS condition. This vulnerability affects all versions of the ASA CX Context-Aware Security module. Cisco has not released and will not release software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCva62946.
CVSS Score: 8.6 (HIGH)
CWE: CWE-399, CWE-399
References: http://www.securityfocus.com/bid/95788; http://www.securitytracker.com/id/1037696; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-cas
CVE: CVE-2017-3790
Published: 2017-02-01
Description: A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software could allow an unauthenticated, remote attacker to cause a reload of the affected system, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient size validation of user-supplied data. An attacker could exploit this vulnerability by sending crafted H.224 data in Real-Time Transport Protocol (RTP) packets in an H.323 call. An exploit could allow the attacker to overflow a buffer in a cache that belongs to the received packet parser, which will result in a crash of the application, resulting in a DoS condition. All versions of Cisco Expressway Series Software and Cisco TelePresence VCS Software prior to version X8.8.2 are vulnerable. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCus99263.
CVSS Score: 8.6 (HIGH)
CWE: CWE-399, CWE-20, CWE-119
References: http://www.securityfocus.com/bid/95786; http://www.securitytracker.com/id/1037697; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-expressway
CVE: CVE-2017-3791
Published: 2017-02-01
Description: A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The vulnerability is due to a processing error in the role-based access control (RBAC) of URLs. An attacker could exploit this vulnerability by sending API commands via HTTP to a particular URL without prior authentication. An exploit could allow the attacker to perform any actions in Cisco Prime Home with administrator privileges. This vulnerability affects Cisco Prime Home versions from 6.3.0.0 to the first fixed release 6.5.0.1. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCvb49837.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.securityfocus.com/bid/95933; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170201-prime-home; http://www.securityfocus.com/bid/95933
CVE: CVE-2017-3792
Published: 2017-02-01
Description: A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to improper size validation when reassembling fragmented IPv4 or IPv6 packets. An attacker could exploit this vulnerability by sending crafted IPv4 or IPv6 fragments to a port receiving content in Passthrough content mode. An exploit could allow the attacker to overflow a buffer. If successful, the attacker could execute arbitrary code or cause a DoS condition on the affected system. Cisco TelePresence MCU platforms TelePresence MCU 5300 Series, TelePresence MCU MSE 8510 and TelePresence MCU 4500 are affected when running software version 4.3(1.68) or later configured for Passthrough content mode. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available, but mitigations are available. Cisco Bug IDs: CSCuu67675.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/95787; http://www.securitytracker.com/id/1037698; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-telepresence
CVE: CVE-2016-0265
Published: 2017-02-01
Description: IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21986033; http://www.securityfocus.com/bid/95100; http://www.ibm.com/support/docview.wss?uid=swg21986033
CVE: CVE-2016-0296
Published: 2017-02-01
Description: IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: http://www.ibm.com/support/docview.wss?uid=swg21993213; http://www.securityfocus.com/bid/94213; http://www.ibm.com/support/docview.wss?uid=swg21993213
CVE: CVE-2016-0297
Published: 2017-02-01
Description: IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transport-Security Header through man in the middle techniques.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21993214; http://www.securityfocus.com/bid/94188; http://www.ibm.com/support/docview.wss?uid=swg21993214
CVE: CVE-2016-0394
Published: 2017-02-01
Description: IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files.
CVSS Score: 3.3 (LOW)
CWE: CWE-275
References: http://www.ibm.com/support/docview.wss?uid=swg21985013; http://www.securityfocus.com/bid/94577; http://www.ibm.com/support/docview.wss?uid=swg21985013
CVE: CVE-2016-0396
Published: 2017-02-01
Description: IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than expected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: http://www.ibm.com/support/docview.wss?uid=swg21993206; http://www.securityfocus.com/bid/94155; http://www.ibm.com/support/docview.wss?uid=swg21993206
CVE: CVE-2016-2908
Published: 2017-02-01
Description: IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: http://www.ibm.com/support/docview.wss?uid=swg21995531; http://www.securityfocus.com/bid/95295; http://www.securitytracker.com/id/1038506
CVE: CVE-2016-2938
Published: 2017-02-01
Description: IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21992835; http://www.securityfocus.com/bid/94600; http://www.securitytracker.com/id/1037383
CVE: CVE-2016-2939
Published: 2017-02-01
Description: IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21992835; http://www.securityfocus.com/bid/94605; http://www.securitytracker.com/id/1037383
CVE: CVE-2016-2987
Published: 2017-02-01
Description: An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/95109; https://www.ibm.com/support/docview.wss?uid=swg21996097; http://www.securityfocus.com/bid/95109
CVE: CVE-2016-3016
Published: 2017-02-01
Description: IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, which could allow an authenticated attacker to load malicious code.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-345
References: http://www.ibm.com/support/docview.wss?uid=swg21995518; http://www.ibm.com/support/docview.wss?uid=swg21995518
CVE: CVE-2016-3017
Published: 2017-02-01
Description: IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-358
References: http://www.ibm.com/support/docview.wss?uid=swg21995519; http://www.ibm.com/support/docview.wss?uid=swg21995519
CVE: CVE-2016-3018
Published: 2017-02-01
Description: IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21995347; http://www.securityfocus.com/bid/96380; http://www.ibm.com/support/docview.wss?uid=swg21995347
CVE: CVE-2016-3021
Published: 2017-02-01
Description: IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP request.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21995436; http://www.securityfocus.com/bid/96114; http://www.ibm.com/support/docview.wss?uid=swg21995436
CVE: CVE-2016-3022
Published: 2017-02-01
Description: IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-275
References: http://www.ibm.com/support/docview.wss?uid=swg21995360; http://www.securityfocus.com/bid/96130; http://www.ibm.com/support/docview.wss?uid=swg21995360
CVE: CVE-2016-3023
Published: 2017-02-01
Description: IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file names.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21995348; http://www.securityfocus.com/bid/96124; http://www.ibm.com/support/docview.wss?uid=swg21995348
CVE: CVE-2016-3024
Published: 2017-02-01
Description: IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21995340; http://www.securityfocus.com/bid/96132; http://www.ibm.com/support/docview.wss?uid=swg21995340