CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2016-5898
https://notcve.org/view.php?id=CVE-2016-5898
01 Feb 2017 — IBM Jazz Reporting Service (JRS) could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a direct request, an attacker could exploit this vulnerability to obtain sensitive information. IBM Jazz Reporting Service (JRS) podrían permitir a un atacante remoto obtener información sensible, causada por no restringir la serialización de JSON. Al enviar una petición directa, un atacante podría explotar esta vulnerabilidad para obtener información sensi... • http://www.ibm.com/support/docview.wss?uid=swg21991154 • CWE-254: 7PK - Security Features •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2016-5899
https://notcve.org/view.php?id=CVE-2016-5899
01 Feb 2017 — IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Jazz Reporting Service (JRS) es vulnerable a las secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la IU Web alterando así la funcionalidad prevista que potencialmente ... • http://www.ibm.com/support/docview.wss?uid=swg21991154 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2016-6039
https://notcve.org/view.php?id=CVE-2016-6039
01 Feb 2017 — IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Jazz Reporting Service (JRS) es vulnerable a las secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la IU Web alterando así la funcionalidad prevista que potencialmente ... • http://www.ibm.com/support/docview.wss?uid=swg21991153 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6047
https://notcve.org/view.php?id=CVE-2016-6047
01 Feb 2017 — IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Jazz Reporting Service (JRS) es vulnerable a las secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la IU Web alterando así la funcionalidad prevista que potencialmente ... • http://www.ibm.com/support/docview.wss?uid=swg21991154 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2016-6054
https://notcve.org/view.php?id=CVE-2016-6054
01 Feb 2017 — IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Jazz Foundation es vulnerable a las secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la IU Web alterando así la funcionalidad prevista que potencialmente conduce a la divulgación d... • http://www.ibm.com/support/docview.wss?uid=swg21991154 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2016-0316
https://notcve.org/view.php?id=CVE-2016-0316
25 Nov 2016 — Cross-site scripting (XSS) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 and 6.0.2 before iFix003 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en Lifecycle Query Engine (LQE) en IBM Jazz Reporting Service 6.0 y 6.0.1 en versiones anteriores a 6.0.1 iFix006 y 6.0.2 en versiones anteriores a iFix003 permite a usuarios remotos autenticados inyectar secuencias de comandos web o H... • http://www-01.ibm.com/support/docview.wss?uid=swg21983137 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-0317
https://notcve.org/view.php?id=CVE-2016-0317
25 Nov 2016 — Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors. Lifecycle Query Engine (LQE) en IBM Jazz Reporting Service 6.0 y 6.0.1 en versiones anteriores a 6.0.1 iFix006 permite a atacantes remotos llevar a cabo ataques de clickjacking a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg21983137 • CWE-284: Improper Access Control •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2016-0318
https://notcve.org/view.php?id=CVE-2016-0318
25 Nov 2016 — Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout action, which allows remote attackers to obtain access by leveraging an unattended workstation. Lifecycle Query Engine (LQE) en IBM Jazz Reporting Service 6.0 y 6.0.1 en versiones anteriores a 6.0.1 iFix006 no destruye un ID de sesión en una acción de cierre de sesión, lo que permite a atacantes remotos obtener acceso aprovechando una estación de trabajo desatendida. • http://www-01.ibm.com/support/docview.wss?uid=swg21983137 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-0319
https://notcve.org/view.php?id=CVE-2016-0319
25 Nov 2016 — The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote authenticated administrators to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. El analizador XML en Lifecycle Query Engine (LQE) en IBM Jazz Reporting Service 6.0 y 6.0.1 en versiones anteriores a 6.0.1 iFix006 permite a administrado... • http://www-01.ibm.com/support/docview.wss?uid=swg21983137 • CWE-284: Improper Access Control •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2016-2888
https://notcve.org/view.php?id=CVE-2016-2888
08 Jul 2016 — Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0313 and CVE-2016-0350. Vulnerabilidad de XSS en el Report Builder and Data Collection Component (DCC) en IBM Jazz Reporting Service (JRS) 5.x en versiones anteriores a 5.0.2 ifix016 y 6.x en... • http://www-01.ibm.com/support/docview.wss?uid=swg21983147 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •