CVE-2016-9000
published 2017-02-01CVE-2016-9000: IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this…
PriorityP426medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
1.15%
63.2th percentile
IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | infosphere_datastage | — | — |
| ibm | infosphere_datastage | — | — |
| ibm | infosphere_datastage | — | — |
| ibm | infosphere_datastage | — | — |
| ibm | infosphere_information_server_on_cloud | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ibm_corporation | infosphere_information_server | — | — |
| ws_project | ws | >= 0 < 1.0.1 | 1.0.1 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6f3w-94mp-xmw9: IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection
ghsa_unreviewed·2022-05-17
CVE-2016-9000 [MEDIUM] CWE-79 GHSA-6f3w-94mp-xmw9: IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection
IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.
GHSA
Remote Memory Disclosure in ws
ghsa·2019-02-18
CVE-2016-10518 [LOW] CWE-201 Remote Memory Disclosure in ws
Remote Memory Disclosure in ws
Versions of `ws` prior to 1.0.1 are affected by a remote memory disclosure vulnerability.
In certain rare circumstances, applications which allow users to control the arguments of a `client.ping()` call will cause `ws` to send the contents of an allocated but non-zero-filled buffer to the server. This may disclose sensitive information that still exists in memory after previous use of the memory for other tasks.
## Proof of Concept
```
var ws = require('ws')
var server = new ws.Server({ port: 9000 })
var client = new ws('ws://localhost:9000')
client.on('open', function () {
console.log('open')
client.ping(50) // this sends a non-zeroed buffer of 50 bytes
client.on('pong', function (data) {
console.log('got pong')
console.log(data) // Data from the clie
Cisco
Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
vendor_cisco·2016-11-02·CVSS 6.1
CVE-2016-6457 [MEDIUM] CWE-119 Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
A vulnerability in the Cisco Nexus 9000 Series Platform Leaf Switches for Application Centric Infrastructure (ACI) could allow
an unauthenticated, adjacent attacker to cause a denial of service (DoS)
condition on the affected device.
The vulnerability is due to
improper handling of a type of Layer 2 control plane traffic. An attacker could exploit
this vulnerability by sending crafted traffic to a host behind a leaf switch. An
exploit could allow the attacker to cause a DoS condition on the affected device.
Cisco has released software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.c
Cisco
Cisco Nexus 9000 Information Disclosure Vulnerability
vendor_cisco·2016-10-05·CVSS 5.0
CVE-2016-1455 [MEDIUM] CWE-200 Cisco Nexus 9000 Information Disclosure Vulnerability
Cisco Nexus 9000 Information Disclosure Vulnerability
A vulnerability in the internal iptables configuration for local interfaces on the Cisco Nexus 9000 Series Switch could allow an unauthenticated, remote attacker to access certain sensitive data. The attacker could use this information to conduct additional reconnaissance attacks.
The vulnerability is due to incorrect filtering of network traffic destined to certain TCP and UDP ports configured on a local interface. An attacker could exploit this vulnerability by connecting to the affected device on one of the exposed TCP or UDP ports. An exploit could allow the attacker to discover certain sensitive data which should be restricted and could be used to conduct further attacks.
Cisco has released software updates that address this vul
Cisco
Cisco IOS XR for Cisco ASR 9000 Series Aggregation Services Routers Interface Flap Vulnerability
vendor_cisco·2016-04-12·CVSS 4.3
CVE-2016-1376 [MEDIUM] CWE-20 Cisco IOS XR for Cisco ASR 9000 Series Aggregation Services Routers Interface Flap Vulnerability
Cisco IOS XR for Cisco ASR 9000 Series Aggregation Services Routers Interface Flap Vulnerability
A vulnerability in packet processing functions of Cisco IOS XR Software running on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause cyclic redundancy check (CRC) and symbol errors on the receiving interface of an affected device, which may lead to an interface flap.
The vulnerability is due to improper processing of packets that contain certain crafted bit patterns. An attacker could exploit this vulnerability by sending crafted packets to be processed by a line card of an affected device. A successful exploit could allow the attacker to cause CRC and symbol errors on the receiving interface of the device, which may lead to an interfa
Cisco
Cisco Nexus 9000 Information Disclosure Vulnerability
vendor_cisco
CVE-2016-1455 Cisco Nexus 9000 Information Disclosure Vulnerability
CVE-2016-1455: Cisco Nexus 9000 Information Disclosure Vulnerability
A vulnerability in the internal iptables configuration for local interfaces on the Cisco Nexus 9000 Series Switch could allow an unauthenticated, remote attacker to access certain sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to incorrect filtering of network traffic destined to certain TCP and UDP ports configured on a local interface. An attacker could exploit this vulnerability by connecting to the affected device on one of the exposed TCP or UDP ports. An exploit could allow the attacker to discover certain sensitive data which should be restricted and could be used to conduct further attacks. Cisco has released software updates that addr
Cisco
Cisco IOS XR for Cisco ASR 9000 Series Aggregation Services Routers Interface Flap Vulnerability
vendor_cisco
CVE-2016-1376 Cisco IOS XR for Cisco ASR 9000 Series Aggregation Services Routers Interface Flap Vulnerability
CVE-2016-1376: Cisco IOS XR for Cisco ASR 9000 Series Aggregation Services Routers Interface Flap Vulnerability
A vulnerability in packet processing functions of Cisco IOS XR Software running on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause cyclic redundancy check (CRC) and symbol errors on the receiving interface of an affected device, which may lead to an interface flap. The vulnerability is due to improper processing of packets that contain certain crafted bit patterns. An attacker could exploit this vulnerability by sending crafted packets to be processed by a line card of an affected device. A successful exploit could allow the attacker to cause CRC and symbol errors on the receiving interface of the device, which may lead
Cisco
Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
vendor_cisco
CVE-2016-6457 Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
CVE-2016-6457: Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability
A vulnerability in the Cisco Nexus 9000 Series Platform Leaf Switches for Application Centric Infrastructure (ACI) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to improper handling of a type of Layer 2 control plane traffic. An attacker could exploit this vulnerability by sending crafted traffic to a host behind a leaf switch. An exploit could allow the attacker to cause a DoS condition on the affected device. Cisco has released software updates that address this vulnerability. There are no
CWE: CWE-119, CWE-119
Bug IDs: CSCuy93241
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-02-01
Published