deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-9644
Published: 2016-11-28
Description: The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application.  NOTE: this vulnerability exists because of incorrect backporting of the CVE-2016-9178 patch to older kernels.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2016/11/07/4; http://www.securityfocus.com/bid/94545; http://www.ubuntu.com/usn/USN-3146-1
CVE: CVE-2016-5393
Published: 2016-11-29
Description: In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E; http://www.securityfocus.com/bid/94574; http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E
CVE: CVE-2016-5765
Published: 2016-11-29
Description: Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote unauthenticated attackers to read arbitrary files via a specially crafted URL that allows limited directory traversal. Applies to MSS 12.3 before 12.3.326 and MSS 12.2 before 12.2.342 and RSG 12.1 before 12.1.362 and RWeb 12.3 before 12.3.312 and RWeb 12.2 before 12.2.342 and RWeb 12.1 before 12.1.362 and ZFE 2.0.1 before 2.0.1.18 and ZFE 2.0.0 before 2.0.0.52 and ZFE 1.4.0 before 1.4.0.14.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-200
References: http://support.attachmate.com/techdocs/1704.html; http://www.securityfocus.com/bid/94579; http://www.zerodayinitiative.com/advisories/ZDI-16-618
CVE: CVE-2016-5685
Published: 2016-11-29
Description: Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://en.community.dell.com/techcenter/extras/m/white_papers/20443326; http://www.securityfocus.com/bid/94585; http://en.community.dell.com/techcenter/extras/m/white_papers/20443326
CVE: CVE-2016-1247
Published: 2016-11-29
Description: The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://packetstormsecurity.com/files/139750/Nginx-Debian-Based-Distros-Root-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2016/Nov/78; http://seclists.org/fulldisclosure/2017/Jan/33
CVE: CVE-2016-1251
Published: 2016-11-29
Description: There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4.041 when used with mysql_server_prepare=1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2016/11/28/2; http://www.securityfocus.com/bid/94573; https://anonscm.debian.org/cgit/pkg-perl/packages/libdbd-mysql-perl.git/commit/?id=a8b97e4713391b1f8beffbfddac483c276feaff1
CVE: CVE-2016-8223
Published: 2016-11-29
Description: During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation software installed on some Windows 10 PCs where a user with local privileges could run arbitrary code with administrator level privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94597; https://support.lenovo.com/us/en/solutions/LEN_10150; http://www.securityfocus.com/bid/94597
CVE: CVE-2016-8224
Published: 2016-11-29
Description: A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install a program that circumvents Intel Management Engine (ME) protections. This could result in a denial of service or privilege escalation attack on the system.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-310
References: http://www.securityfocus.com/bid/94595; https://support.lenovo.com/us/en/solutions/LEN_9903; http://www.securityfocus.com/bid/94595
CVE: CVE-2016-9480
Published: 2016-11-29
Description: libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed dwarf file" approach, related to a "Heap Buffer Over-read" issue affecting the dwarf_util.c component, aka DW201611-006.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94980; https://sourceforge.net/p/libdwarf/bugs/5/; https://sourceforge.net/p/libdwarf/code/ci/5dd64de047cd5ec479fb11fe7ff2692fd819e5e5/
CVE: CVE-2016-9481
Published: 2016-11-29
Description: In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this->params['content_id']' used directly in SQL. Impact is a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.pang0lin.com/?p=1076; http://www.securityfocus.com/bid/94590; http://www.securitytracker.com/id/1037368
CVE: CVE-2016-2931
Published: 2016-11-30
Description: IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive cleartext information by sniffing the network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89791; http://www-01.ibm.com/support/docview.wss?uid=swg21991876; http://www.securityfocus.com/bid/94984
CVE: CVE-2016-2932
Published: 2016-11-30
Description: IBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML injection attacks via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-91
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89787; http://www-01.ibm.com/support/docview.wss?uid=swg21991882; http://www.securityfocus.com/bid/94983
CVE: CVE-2016-2933
Published: 2016-11-30
Description: Directory traversal vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated administrators to read arbitrary files via a crafted request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89780; http://www-01.ibm.com/support/docview.wss?uid=swg21991892; http://www.securityfocus.com/bid/94986
CVE: CVE-2016-2934
Published: 2016-11-30
Description: Cross-site scripting (XSS) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89795; http://www-01.ibm.com/support/docview.wss?uid=swg21991870; http://www.securityfocus.com/bid/94987
CVE: CVE-2016-2935
Published: 2016-11-30
Description: The broker application in IBM BigFix Remote Control before 9.1.3 allows remote attackers to cause a denial of service via an invalid HTTP request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89745; http://www-01.ibm.com/support/docview.wss?uid=swg21991955; http://www.securityfocus.com/bid/94989
CVE: CVE-2016-2936
Published: 2016-11-30
Description: IBM BigFix Remote Control before 9.1.3 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive information via unknown vectors.
CVSS Score: 7.3 (HIGH)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89786; http://www-01.ibm.com/support/docview.wss?uid=swg21991884; http://www.securityfocus.com/bid/94645
CVE: CVE-2016-2937
Published: 2016-11-30
Description: IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted POST request, related to an "untrusted information vulnerability."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89783; http://www-01.ibm.com/support/docview.wss?uid=swg21991887; http://www.securityfocus.com/bid/94646
CVE: CVE-2016-2940
Published: 2016-11-30
Description: Multiple unspecified vulnerabilities in IBM BigFix Remote Control before 9.1.3 allow remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89735; http://www-01.ibm.com/support/docview.wss?uid=swg21991961; http://www.securityfocus.com/bid/94621
CVE: CVE-2016-2943
Published: 2016-11-30
Description: IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by leveraging unspecified privileges to read a log file.
CVSS Score: 1.9 (LOW)
CWE: CWE-532
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89736; http://www-01.ibm.com/support/docview.wss?uid=swg21991960; http://www.securityfocus.com/bid/94617
CVE: CVE-2016-2944
Published: 2016-11-30
Description: IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89790; http://www-01.ibm.com/support/docview.wss?uid=swg21991878; http://www.securityfocus.com/bid/94623
CVE: CVE-2016-2948
Published: 2016-11-30
Description: IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89781; http://www-01.ibm.com/support/docview.wss?uid=swg21991889; http://www.securityfocus.com/bid/94619
CVE: CVE-2016-2949
Published: 2016-11-30
Description: IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by reading cached web pages from a different user's session.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89740; http://www-01.ibm.com/support/docview.wss?uid=swg21991959; http://www.securityfocus.com/bid/94608
CVE: CVE-2016-2950
Published: 2016-11-30
Description: SQL injection vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89784; http://www-01.ibm.com/support/docview.wss?uid=swg21991886; http://www.securityfocus.com/bid/94607
CVE: CVE-2016-2951
Published: 2016-11-30
Description: IBM BigFix Remote Control before 9.1.3 does not properly set the default encryption strength, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and performing calculations on encrypted data.
CVSS Score: 3.7 (LOW)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89785; http://www-01.ibm.com/support/docview.wss?uid=swg21991885; http://www.securityfocus.com/bid/94601
CVE: CVE-2016-2952
Published: 2016-11-30
Description: IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89794; http://www-01.ibm.com/support/docview.wss?uid=swg21991871; http://www.securityfocus.com/bid/94598
CVE: CVE-2016-2953
Published: 2016-11-30
Description: IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive cleartext information by sniffing the network.
CVSS Score: 3.7 (LOW)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO90268; http://www-01.ibm.com/support/docview.wss?uid=swg1LO90295; http://www-01.ibm.com/support/docview.wss?uid=swg21990888
CVE: CVE-2016-2957
Published: 2016-11-30
Description: IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading a stack trace in a response.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO90039; http://www-01.ibm.com/support/docview.wss?uid=swg21990864; http://www.securityfocus.com/bid/94300
CVE: CVE-2016-2958
Published: 2016-11-30
Description: IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading an "archaic" e-mail address in a response.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO90039; http://www-01.ibm.com/support/docview.wss?uid=swg21990864; http://www.securityfocus.com/bid/94328
CVE: CVE-2016-2963
Published: 2016-11-30
Description: Cross-site request forgery (CSRF) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89797; http://www-01.ibm.com/support/docview.wss?uid=swg21991867; http://www.securityfocus.com/bid/94596
CVE: CVE-2016-3002
Published: 2016-11-30
Description: IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows physically proximate attackers to obtain sensitive information by reading cached data on a client device.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO90039; http://www-01.ibm.com/support/docview.wss?uid=swg21990864; http://www.securityfocus.com/bid/94331
CVE: CVE-2016-3004
Published: 2016-11-30
Description: Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the set of available applications.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO90039; http://www-01.ibm.com/support/docview.wss?uid=swg21990864; http://www.securityfocus.com/bid/94332
CVE: CVE-2016-3009
Published: 2016-11-30
Description: Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the Connections generic page.
CVSS Score: 3.5 (LOW)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO90039; http://www-01.ibm.com/support/docview.wss?uid=swg21990864; http://www.securityfocus.com/bid/94329
CVE: CVE-2016-3014
Published: 2016-11-30
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Quality Manager 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Team Concert 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational DOORS Next Generation 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21992151; http://www.securityfocus.com/bid/93515; http://www.securitytracker.com/id/1037025
CVE: CVE-2016-3057
Published: 2016-11-30
Description: Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.2 before 5020500_14 and 5.2 06 before 5020602_1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT15790; http://www-01.ibm.com/support/docview.wss?uid=swg21989578; http://www.securityfocus.com/bid/94389
CVE: CVE-2016-5890
Published: 2016-11-30
Description: IBM Sterling B2B Integrator 5.2 before 5020500_14 and 5.2 06 before 5020602_1 allows remote authenticated users to change arbitrary passwords via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT16043; http://www-01.ibm.com/support/docview.wss?uid=swg21989577; http://www.securityfocus.com/bid/94391
CVE: CVE-2016-5905
Published: 2016-11-30
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.10 IF3 and 7.6 before 7.6.0.5 IF2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21988253; http://www.securityfocus.com/bid/93871; http://www-01.ibm.com/support/docview.wss?uid=swg21988253
CVE: CVE-2016-5987
Published: 2016-11-30
Description: IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.10 IF4, and 7.6 before 7.6.0.5 IF3 allows remote attackers to obtain sensitive information via a crafted HTTP request that triggers construction of a runtime error message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21990449; http://www.securityfocus.com/bid/93511; http://www-01.ibm.com/support/docview.wss?uid=swg21990449
CVE: CVE-2016-9564
Published: 2016-11-30
Description: Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET request requesting a long URI with only '/' and '.' characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.ljcusack.io/cve-2016-9564-stack-based-buffer-overflow-in-boa-0-dot-92r; http://www.securityfocus.com/bid/94599; http://www.ljcusack.io/cve-2016-9564-stack-based-buffer-overflow-in-boa-0-dot-92r
CVE: CVE-2016-8222
Published: 2016-11-30
Description: A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). The setting or changing of BIOS passwords is not affected by this vulnerability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94409; https://support.lenovo.com/us/en/solutions/LEN_8327; http://www.securityfocus.com/bid/94409
CVE: CVE-2016-2869
Published: 2016-11-30
Description: Multiple cross-site scripting (XSS) vulnerabilities in the UI in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote authenticated users to inject arbitrary web script or HTML via crafted fields in a URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987768; http://www.securityfocus.com/bid/94859; http://www-01.ibm.com/support/docview.wss?uid=swg21987768
CVE: CVE-2016-2871
Published: 2016-11-30
Description: IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive information by reading a configuration file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987769; http://www.securityfocus.com/bid/94861; http://www-01.ibm.com/support/docview.wss?uid=swg21987769
CVE: CVE-2016-2873
Published: 2016-11-30
Description: SQL injection vulnerability in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987770; http://www.securityfocus.com/bid/95000; http://www-01.ibm.com/support/docview.wss?uid=swg21987770
CVE: CVE-2016-2874
Published: 2016-11-30
Description: IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 mishandles authorization, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 3.1 (LOW)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987771; http://www.securityfocus.com/bid/95003; http://www-01.ibm.com/support/docview.wss?uid=swg21987771
CVE: CVE-2016-2876
Published: 2016-11-30
Description: IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 executes unspecified processes at an incorrect privilege level, which makes it easier for remote authenticated users to obtain root access by leveraging a command-injection issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987774; http://www.securityfocus.com/bid/95001; http://www-01.ibm.com/support/docview.wss?uid=swg21987774
CVE: CVE-2016-2877
Published: 2016-11-30
Description: IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses weak permissions for unspecified directories under the web root, which allows local users to modify data by writing to a file.
CVSS Score: 3.3 (LOW)
CWE: CWE-275
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987773; http://www.securityfocus.com/bid/95002; http://www-01.ibm.com/support/docview.wss?uid=swg21987773
CVE: CVE-2016-2878
Published: 2016-11-30
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987776; http://www.securityfocus.com/bid/95004; http://www-01.ibm.com/support/docview.wss?uid=swg21987776
CVE: CVE-2016-2881
Published: 2016-11-30
Description: IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 and QRadar Incident Forensics 7.2 before 7.2.7 allow remote attackers to bypass intended access restrictions via modified request parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg21987777; http://www-01.ibm.com/support/docview.wss?uid=swg21987777
CVE: CVE-2016-2884
Published: 2016-11-30
Description: Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO89686; http://www-01.ibm.com/support/docview.wss?uid=swg21987252; http://www-01.ibm.com/support/docview.wss?uid=swg1LO89686
CVE: CVE-2016-2887
Published: 2016-11-30
Description: IBM IMS Enterprise Suite Data Provider before 3.2.0.1 for Microsoft .NET allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200, CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21982967; http://www.securityfocus.com/bid/94611; http://www-01.ibm.com/support/docview.wss?uid=swg21982967