deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-9536
Published: 2016-11-22
Description: tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka "t2p_process_jpeg_strip heap-buffer-overflow."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0225.html; http://www.debian.org/security/2017/dsa-3762; http://www.securityfocus.com/bid/94484
CVE: CVE-2016-9537
Published: 2016-11-22
Description: tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR 35096, and MSVR 35097.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0225.html; http://www.debian.org/security/2017/dsa-3762; http://www.securityfocus.com/bid/94484
CVE: CVE-2016-9538
Published: 2016-11-22
Description: tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer overflow. Reported as MSVR 35100.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://www.debian.org/security/2017/dsa-3762; http://www.securityfocus.com/bid/94484; http://www.securityfocus.com/bid/94753
CVE: CVE-2016-9539
Published: 2016-11-22
Description: tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-125
References: http://www.securityfocus.com/bid/94484; http://www.securityfocus.com/bid/94754; https://github.com/vadz/libtiff/commit/ae9365db1b271b62b35ce018eac8799b1d5e8a53
CVE: CVE-2016-9540
Published: 2016-11-22
Description: tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-787
References: http://rhn.redhat.com/errata/RHSA-2017-0225.html; http://www.debian.org/security/2017/dsa-3762; http://www.securityfocus.com/bid/94484
CVE: CVE-2016-9562
Published: 2016-11-23
Description: SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer exception and icman outage) via an HTTPS request to the sap.com~P4TunnelingApp!web/myServlet URI, aka SAP Security Note 2313835.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://www.securityfocus.com/bid/92418; http://www.securityfocus.com/bid/95363; https://erpscan.io/advisories/erpscan-16-033-sap-netweaver-java-icman-dos-vulnerability/
CVE: CVE-2016-9563
Published: 2016-11-23
Description: BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: http://www.securityfocus.com/bid/92419; https://erpscan.io/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/; https://launchpad.support.sap.com/#/notes/2296909
CVE: CVE-2016-8672
Published: 2016-11-23
Description: A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server delivers cookies without the "secure" flag. Modern browsers interpreting the flag would mitigate potential data leakage in case of clear text transmission.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://cert-portal.siemens.com/productcert/pdf/ssa-603476.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-603476.pdf
CVE: CVE-2016-8673
Published: 2016-11-23
Description: A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server at port 80/TCP or port 443/TCP of the affected devices could allow remote attackers to perform actions with the permissions of an authenticated user, provided the targeted user has an active session and is induced to trigger the malicious request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://cert-portal.siemens.com/productcert/pdf/ssa-603476.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-603476.pdf
CVE: CVE-2016-9567
Published: 2016-11-23
Description: The mDNIe system service on Samsung Mobile S7 devices with M(6.0) software does not properly restrict setmDNIeScreenCurtain API calls, enabling attackers to control a device's screen. This can be exploited via a crafted application to eavesdrop after phone shutdown or record a conversation. The Samsung ID is SVE-2016-6343.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://security.samsungmobile.com/smrupdate.html#SMR-NOV-2016; http://www.securityfocus.com/bid/94494; http://security.samsungmobile.com/smrupdate.html#SMR-NOV-2016
CVE: CVE-2016-1248
Published: 2016-11-23
Description: vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://openwall.com/lists/oss-security/2016/11/22/20; http://rhn.redhat.com/errata/RHSA-2016-2972.html; http://www.debian.org/security/2016/dsa-3722
CVE: CVE-2015-4961
Published: 2016-11-24
Description: IBM Tealeaf Customer Experience 8.x before 8.7.1.8847 FP10, 8.8.x before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108 FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224 FP3 does not encrypt connections between internal servers, which allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21965077; http://www.securityfocus.com/bid/94976; http://www-01.ibm.com/support/docview.wss?uid=swg21965077
CVE: CVE-2016-0273
Published: 2016-11-24
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991478; http://www.securityfocus.com/bid/94557; http://www-01.ibm.com/support/docview.wss?uid=swg21991478
CVE: CVE-2016-0282
Published: 2016-11-24
Description: Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 FP6 IF2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYHAAHNUS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991722; http://www.securityfocus.com/bid/94558; http://www.securitytracker.com/id/1037383
CVE: CVE-2016-0284
Published: 2016-11-24
Description: The XML parser in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-611
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991478; http://www.securityfocus.com/bid/94555; http://www-01.ibm.com/support/docview.wss?uid=swg21991478
CVE: CVE-2016-0285
Published: 2016-11-24
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991478; http://www.securityfocus.com/bid/94550; http://www-01.ibm.com/support/docview.wss?uid=swg21991478
CVE: CVE-2016-0325
Published: 2016-11-24
Description: IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allow remote authenticated users to execute arbitrary OS commands via a crafted request.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991478; http://www.securityfocus.com/bid/94539; http://www-01.ibm.com/support/docview.wss?uid=swg21991478
CVE: CVE-2016-0353
Published: 2016-11-24
Description: IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 3.7 (LOW)
CWE: CWE-200, CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg21988706; http://www.securityfocus.com/bid/94543; http://www-01.ibm.com/support/docview.wss?uid=swg21988706
CVE: CVE-2016-0372
Published: 2016-11-24
Description: IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 do not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
CVSS Score: 3.7 (LOW)
CWE: CWE-200, CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991478; http://www.securityfocus.com/bid/94541; http://www-01.ibm.com/support/docview.wss?uid=swg21991478
CVE: CVE-2016-0378
Published: 2016-11-24
Description: IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI54459; http://www-01.ibm.com/support/docview.wss?uid=swg21981529; http://www.securityfocus.com/bid/93143
CVE: CVE-2016-2864
Published: 2016-11-24
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991478; http://www.securityfocus.com/bid/94542; http://www-01.ibm.com/support/docview.wss?uid=swg21991478
CVE: CVE-2016-2996
Published: 2016-11-24
Description: IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, allows remote authenticated users to append to arbitrary files via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21988706; http://www-01.ibm.com/support/docview.wss?uid=swg21988706
CVE: CVE-2016-2947
Published: 2016-11-25
Description: IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allow remote authenticated users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991477; http://www.securityfocus.com/bid/94518; http://www-01.ibm.com/support/docview.wss?uid=swg21991477
CVE: CVE-2016-2984
Published: 2016-11-25
Description: IBM Spectrum Scale 4.1.1.x before 4.1.1.8 and 4.2.x before 4.2.0.4 and General Parallel File System (GPFS) 3.5.x before 3.5.0.32 and 4.1.x before 4.1.1.8 allow local users to gain privileges via crafted command-line parameters to a /usr/lpp/mmfs/bin/ setuid program.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1007994; http://www.securityfocus.com/bid/92410; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1007994
CVE: CVE-2016-2985
Published: 2016-11-25
Description: IBM Spectrum Scale 4.1.1.x before 4.1.1.8 and 4.2.x before 4.2.0.4 and General Parallel File System (GPFS) 3.5.x before 3.5.0.32 and 4.1.x before 4.1.1.8 allow local users to gain privileges via crafted environment variables to a /usr/lpp/mmfs/bin/ setuid program.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=ssg1S1007994; http://www.securityfocus.com/bid/92408; http://www-01.ibm.com/support/docview.wss?uid=ssg1S1007994
CVE: CVE-2016-2986
Published: 2016-11-25
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 6.x before 6.0.1 iFix6, Rational Quality Manager 6.x before 6.0.1 iFix6, Rational Team Concert 6.x before 6.0.1 iFix6, Rational DOORS Next Generation 6.x before 6.0.1 iFix6, Rational Engineering Lifecycle Manager 6.x before 6.0.1 iFix6, and Rational Rhapsody Design Manager 6.x before 6.0.1 iFix6 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21989940; http://www.securityfocus.com/bid/92869; http://www-01.ibm.com/support/docview.wss?uid=swg21989940
CVE: CVE-2016-2988
Published: 2016-11-25
Description: IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.4.x before 6.4.3.4 and 7.1.x before 7.1.6 allows remote authenticated users to bypass a TSM credential requirement and obtain administrative access by leveraging multiple simultaneous logins.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21988781; http://www-01.ibm.com/support/docview.wss?uid=swg21988781
CVE: CVE-2016-3025
Published: 2016-11-25
Description: IBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach.
CVSS Score: 8.1 (HIGH)
CWE: CWE-254
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89240; http://www-01.ibm.com/support/docview.wss?uid=swg1IV89258; http://www-01.ibm.com/support/docview.wss?uid=swg21991107
CVE: CVE-2016-3028
Published: 2016-11-25
Description: IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV89257; http://www-01.ibm.com/support/docview.wss?uid=swg1IV89322; http://www-01.ibm.com/support/docview.wss?uid=swg1IV89326
CVE: CVE-2016-5788
Published: 2016-11-25
Description: General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it easier for remote attackers to obtain privileged access via unspecified vectors.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-254, CWE-285
References: http://www.securityfocus.com/bid/93452; https://ics-cert.us-cert.gov/advisories/ICSA-16-252-01; http://www.securityfocus.com/bid/93452
CVE: CVE-2016-5955
Published: 2016-11-25
Description: Cross-site scripting (XSS) vulnerability in IBM Rational DOORS Next Generation 6.0.2 before iFix004 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21990054; http://www.securityfocus.com/bid/93154; http://www-01.ibm.com/support/docview.wss?uid=swg21990054
CVE: CVE-2016-5967
Published: 2016-11-25
Description: The installation component in IBM Rational Asset Analyzer (RAA) 6.1.0 before FP10 allows local users to discover the WAS Admin password by reading IM native logs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI61540; http://www-01.ibm.com/support/docview.wss?uid=swg21990215; http://www.securityfocus.com/bid/93145
CVE: CVE-2016-5968
Published: 2016-11-25
Description: The Replay Server in IBM Tealeaf Customer Experience 8.x before 8.7.1.8847 FP10, 8.8.x before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108 FP5, 9.0.2 before 9.0.2.1223 FP3, and 9.0.2A before 9.0.2.5224 FP3 allows remote attackers to conduct SSRF attacks via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: http://www-01.ibm.com/support/docview.wss?uid=swg21989374; http://www.securityfocus.com/bid/94516; http://www-01.ibm.com/support/docview.wss?uid=swg21989374
CVE: CVE-2016-5981
Published: 2016-11-25
Description: Cross-site scripting (XSS) vulnerability in IBM FileNet Workplace XT through 1.1.5.2-WPXT-LA011 and FileNet Workplace (Application Engine) through 4.0.2.14-P8AE-IF001, when RegExpSecurityFilter and ScriptSecurityFilter are misconfigured, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21990899; http://www.securityfocus.com/bid/94517; http://www-01.ibm.com/support/docview.wss?uid=swg21990899
CVE: CVE-2016-5991
Published: 2016-11-25
Description: IBM Sterling Connect:Direct 4.5.00, 4.5.01, 4.6.0 before 4.6.0.6 iFix008, and 4.7.0 before 4.7.0.4 on Windows allows local users to gain privileges via unspecified vectors.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT16911; http://www-01.ibm.com/support/docview.wss?uid=swg21989807; http://www.securityfocus.com/bid/94515
CVE: CVE-2016-5992
Published: 2016-11-25
Description: IBM Sterling Connect:Direct 4.5.00, 4.5.01, 4.6.0 before 4.6.0.6 iFix008, and 4.7.0 before 4.7.0.4 on Windows allows local users to cause a denial of service via unspecified vectors.
CVSS Score: 2.5 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT16911; http://www-01.ibm.com/support/docview.wss?uid=swg21989807; http://www.securityfocus.com/bid/94514
CVE: CVE-2016-3904
Published: 2016-11-25
Description: An elevation of privilege vulnerability in the Qualcomm bus driver in Android before 2016-11-05 could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Android ID: A-30311977. References: Qualcomm QC-CR#1050455.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94210; https://source.android.com/security/bulletin/2016-11-01.html; http://www.securityfocus.com/bid/94210