Ibm Connections vulnerabilities
46 known vulnerabilities affecting ibm/connections.
Total CVEs
46
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH2MEDIUM40LOW4
Vulnerabilities
Page 2 of 3
CVE-2016-3008P4MEDIUMCVSS 5.4v5.0.0.0v5.5.0.02016-09-01
CVE-2016-3008 [MEDIUM] CVE-2016-3008: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 bef
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2954 and CVE-2016-2956.
nvd
CVE-2016-2956P4MEDIUMCVSS 5.4v5.0.0.0v5.5.0.02016-09-01
CVE-2016-2956 [MEDIUM] CVE-2016-2956: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 bef
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2954 and CVE-2016-3008.
nvd
CVE-2016-2954P4MEDIUMCVSS 5.4v5.0.0.0v5.5.0.02016-09-01
CVE-2016-2954 [MEDIUM] CWE-79 CVE-2016-2954: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 bef
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2956 and CVE-2016-3008.
nvd
CVE-2017-1682P4MEDIUMCVSS 5.4v4.0v4.5+3 more2018-02-14
CVE-2017-1682 [MEDIUM] CWE-79 CVE-2017-1682: IBM Connections 4.0, 4.5, 5.0, 5.5, and 6.0 is vulnerable to cross-site scripting. This vulnerabilit
IBM Connections 4.0, 4.5, 5.0, 5.5, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134004.
nvd
CVE-2016-5932P4MEDIUMCVSS 5.4v4.0v4.5+2 more2017-03-01
CVE-2016-5932 [MEDIUM] CWE-79 CVE-2016-5932: IBM Connections 4.0, 4.5, 5.0, and 5.5 is vulnerable to cross-site scripting. This vulnerability all
IBM Connections 4.0, 4.5, 5.0, and 5.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998294.
nvd
CVE-2015-5037P4MEDIUMCVSS 5.4≤ 3.0.1.1v4.0+2 more2016-01-03
CVE-2015-5037 [MEDIUM] CWE-352 CVE-2015-5037: Cross-site request forgery (CSRF) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 befor
Cross-site request forgery (CSRF) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
nvd
CVE-2015-7458P4MEDIUMCVSS 5.4≤ 3.0.1.1v4.0.0.0+2 more2018-03-20
CVE-2015-7458 [MEDIUM] CWE-79 CVE-2015-7458: Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 b
Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108354.
nvd
CVE-2015-7459P4MEDIUMCVSS 5.4≤ 3.0.1.1v4.0.0.0+2 more2018-03-20
CVE-2015-7459 [MEDIUM] CWE-79 CVE-2015-7459: Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 b
Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108355.
nvd
CVE-2015-7460P4MEDIUMCVSS 5.4≤ 3.0.1.1v4.0.0.0+2 more2018-03-20
CVE-2015-7460 [MEDIUM] CWE-79 CVE-2015-7460: Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 b
Cross-site scripting (XSS) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 108356.
nvd
CVE-2015-5035P4MEDIUMCVSS 5.4≤ 3.0.1.1v4.0+2 more2016-01-03
CVE-2015-5035 [MEDIUM] CWE-79 CVE-2015-5035: Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4,
Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-5036.
nvd
CVE-2015-5036P4MEDIUMCVSS 5.4≤ 3.0.1.1v4.0+2 more2016-01-03
CVE-2015-5036 [MEDIUM] CVE-2015-5036: Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4,
Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-5035.
nvd
CVE-2016-2955P4MEDIUMCVSS 5.4v5.0.0.0v5.5.0.02016-12-01
CVE-2016-2955 [MEDIUM] CWE-79 CVE-2016-2955: Cross-site scripting (XSS) vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows
Cross-site scripting (XSS) vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2016-0322P4MEDIUMCVSS 5.4v4.0.0.0v4.5.0.0+2 more2016-06-30
CVE-2016-0322 [MEDIUM] CWE-79 CVE-2016-0322: Cross-site scripting (XSS) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 th
Cross-site scripting (XSS) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 through CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML by uploading an HTML document.
nvd
CVE-2018-1791P4MEDIUMCVSS 4.9v5.0v5.5+1 more2018-09-14
CVE-2018-1791 [MEDIUM] CWE-20 CVE-2018-1791: IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by
IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request property. By submitting suitable payloads, an attacker could exploit this vulnerability to induce the Connections server to attack other systems. IBM X-Force ID: 148946.
nvd
CVE-2016-3004P4MEDIUMCVSS 4.6v4.0.0.0v4.5.0.0+1 more2016-11-30
CVE-2016-3004 [MEDIUM] CWE-352 CVE-2016-3004: Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5,
Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the set of available applications.
nvd
CVE-2016-2958P4MEDIUMCVSS 4.3v4.0.0.0v4.5.0.0+1 more2016-11-30
CVE-2016-2958 [MEDIUM] CWE-200 CVE-2016-2958: IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated use
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading an "archaic" e-mail address in a response.
nvd
CVE-2018-1935P4MEDIUMCVSS 4.3v5.0v5.5+1 more2018-12-06
CVE-2018-1935 [MEDIUM] CWE-200 CVE-2018-1935: IBM Connections 5.0, 5.5, and 6.0 could allow an authenticated user to obtain sensitive information
IBM Connections 5.0, 5.5, and 6.0 could allow an authenticated user to obtain sensitive information from invalid request error messages. IBM X-Force ID: 153315.
nvd
CVE-2016-2957P4MEDIUMCVSS 4.3v4.0.0.0v4.5.0.0+1 more2016-11-30
CVE-2016-2957 [MEDIUM] CWE-200 CVE-2016-2957: IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated use
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading a stack trace in a response.
nvd
CVE-2016-0307P4MEDIUMCVSS 4.3v4.0.0.0v4.5.0.0+2 more2017-02-08
CVE-2016-0307 [MEDIUM] CWE-200 CVE-2016-0307: IBM Connections 5.5 and earlier allows remote attackers to obtain sensitive information by reading s
IBM Connections 5.5 and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned responses.
nvd
CVE-2016-0308P4MEDIUMCVSS 4.3v4.0.0.0v4.5.0.0+2 more2017-02-08
CVE-2016-0308 [MEDIUM] CWE-284 CVE-2016-0308: IBM Connections 5.5 and earlier is vulnerable to possible link manipulation attack that could result
IBM Connections 5.5 and earlier is vulnerable to possible link manipulation attack that could result in the display of inappropriate background images.
nvd