CVE Vulnerability Catalog

EMC Isilon OneFS versions 7.2.1.0 - 7.2.1.3, 7.2.0.x, 7.1.1.0 - 7.1.1.10, and 7.1.0.x are affected by a privilege escalation vulnerability that could potentially be exploited by attackers to compromise the affected system.

An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2, related to improper OCSP validation. The lack of a nextUpdate value in OCSP responses is treated as the response being valid indefinitely, which may lead to unauthorized access.

EMC Data Protection Advisor versions 6.1.x, 6.2, 6.2.1, 6.2.2, and 6.2.3 prior to patch 446 contain a path traversal vulnerability that may be exploited by malicious users to compromise the affected system.

IBM AIX versions 6.1, 7.1, and 7.2 contain a vulnerability in the bellmail binary that could allow a local user to gain root privileges.

IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a trusted user.

A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js, which crafts a SQL statement to identify the database in use with the current user's session, potentially allowing unauthorized access.

IBM Security Identity Manager Virtual Appliance stores user credentials in plain text, which can be read by a local user.

IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent.

IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.

IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.

IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources.

IBM General Parallel File System is vulnerable to a buffer overflow. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system with root privileges or cause the server to crash.

IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties.

IBM UrbanCode Deploy could allow an authenticated attacker with special permissions to craft a script on the server in a way that will cause processes to run on a remote UCD agent machine.

IBM Tivoli Key Lifecycle Manager versions 2.5 and 2.6 do not perform an authentication check for critical resources or functionalities, allowing anonymous users access to protected areas.

IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.

IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions on behalf of a trusted user.

IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.