Ibm Connections vulnerabilities
46 known vulnerabilities affecting ibm/connections.
Total CVEs
46
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH2MEDIUM40LOW4
Vulnerabilities
Page 2 of 3
CVE-2016-2957MEDIUMCVSS 4.3v4.0.0.0v4.5.0.0+1 more2016-11-30
CVE-2016-2957 [MEDIUM] CWE-200 CVE-2016-2957: IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated use
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading a stack trace in a response.
nvd
CVE-2016-2958MEDIUMCVSS 4.3v4.0.0.0v4.5.0.0+1 more2016-11-30
CVE-2016-2958 [MEDIUM] CWE-200 CVE-2016-2958: IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated use
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading an "archaic" e-mail address in a response.
nvd
CVE-2016-3002LOWCVSS 2.1v4.0.0.0v4.5.0.0+1 more2016-11-30
CVE-2016-3002 [LOW] CWE-200 CVE-2016-3002: IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows physically proximate att
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows physically proximate attackers to obtain sensitive information by reading cached data on a client device.
nvd
CVE-2016-2953LOWCVSS 3.7v4.0.0.0v4.5.0.0+1 more2016-11-30
CVE-2016-2953 [LOW] CWE-310 CVE-2016-2953: IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which all
IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive cleartext information by sniffing the network.
nvd
CVE-2016-3009LOWCVSS 3.5v4.0.0.0v4.5.0.0+1 more2016-11-30
CVE-2016-3009 [LOW] CWE-352 CVE-2016-3009: Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5,
Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that modify the Connections generic page.
nvd
CVE-2016-3007HIGHCVSS 8.8v4.0.0.0v4.5.0.0+2 more2016-09-26
CVE-2016-3007 [HIGH] CWE-352 CVE-2016-3007: Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before C
Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack the authentication of arbitrary users.
nvd
CVE-2016-3006MEDIUMCVSS 5.4v4.0.0.0v4.5.0.0+2 more2016-09-26
CVE-2016-3006 [MEDIUM] CVE-2016-3006: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 b
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3003.
nvd
CVE-2016-3000MEDIUMCVSS 4.3v4.0.0.0v4.5.0.0+2 more2016-09-26
CVE-2016-3000 [MEDIUM] CWE-20 CVE-2016-3000: The help service in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows r
The help service in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to cause a denial of service (service degradation) via a crafted URL.
nvd
CVE-2016-3001MEDIUMCVSS 5.4v4.0.0.0v4.5.0.0+2 more2016-09-26
CVE-2016-3001 [MEDIUM] CWE-79 CVE-2016-3001: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 b
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3003 and CVE-2016-3006.
nvd
CVE-2016-2999MEDIUMCVSS 6.5≤ 5.5.0.02016-09-26
CVE-2016-2999 [MEDIUM] CWE-200 CVE-2016-2999: IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated
IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sensitive information via an unspecified brute-force attack.
nvd
CVE-2016-3003MEDIUMCVSS 5.4v4.0.0.0v4.5.0.0+2 more2016-09-26
CVE-2016-3003 [MEDIUM] CVE-2016-3003: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 b
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via an embedded string, a different vulnerability than CVE-2016-3001 and CVE-2016-3006.
nvd
CVE-2016-3008MEDIUMCVSS 5.4v5.0.0.0v5.5.0.02016-09-01
CVE-2016-3008 [MEDIUM] CVE-2016-3008: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 bef
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2954 and CVE-2016-2956.
nvd
CVE-2016-3005MEDIUMCVSS 5.4v4.0.0.0v4.5.0.0+2 more2016-09-01
CVE-2016-3005 [MEDIUM] CVE-2016-3005: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 throu
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2995, CVE-2016-2997, and CVE-2016-3010.
nvd
CVE-2016-2956MEDIUMCVSS 5.4v5.0.0.0v5.5.0.02016-09-01
CVE-2016-2956 [MEDIUM] CVE-2016-2956: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 bef
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2954 and CVE-2016-3008.
nvd
CVE-2016-2995MEDIUMCVSS 5.4v4.0.0.0v4.5.0.0+2 more2016-09-01
CVE-2016-2995 [MEDIUM] CWE-79 CVE-2016-2995: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 throu
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2997, CVE-2016-3005, and CVE-2016-3010.
nvd
CVE-2016-2997MEDIUMCVSS 5.4v4.0.0.0v4.5.0.0+2 more2016-09-01
CVE-2016-2997 [MEDIUM] CVE-2016-2997: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 throu
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2995, CVE-2016-3005, and CVE-2016-3010.
nvd
CVE-2016-2954MEDIUMCVSS 5.4v5.0.0.0v5.5.0.02016-09-01
CVE-2016-2954 [MEDIUM] CWE-79 CVE-2016-2954: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 bef
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2956 and CVE-2016-3008.
nvd
CVE-2016-3010MEDIUMCVSS 5.4v4.0.0.0v4.5.0.0+2 more2016-09-01
CVE-2016-3010 [MEDIUM] CVE-2016-3010: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 throu
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-2995, CVE-2016-2997, and CVE-2016-3005.
nvd
CVE-2016-2998LOWCVSS 3.5v4.0.0.0v4.5.0.0+2 more2016-09-01
CVE-2016-2998 [LOW] CWE-352 CVE-2016-2998: Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5,
Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update data.
nvd
CVE-2016-0322MEDIUMCVSS 5.4v4.0.0.0v4.5.0.0+2 more2016-06-30
CVE-2016-0322 [MEDIUM] CWE-79 CVE-2016-0322: Cross-site scripting (XSS) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 th
Cross-site scripting (XSS) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 through CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML by uploading an HTML document.
nvd