InfoSphere Information Server vulnerabilities
25 known vulnerabilities in InfoSphere Information Server from IBM. 25 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
InfoSphere Information Server: Improper Restriction of XML External Entity Reference
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 An XML External Entity (XXE) vulnerability in IBM InfoSphere Information Server could allow attackers to retrieve sensitive information from the server.
- 9.1 Critical severity
InfoSphere Information Server: Improper Restriction of XML External Entity Reference
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- 7.8 High severity
InfoSphere Information Server: Execution with Unnecessary Privileges
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a non-root user to gain higher privileges/capabilities within the scope of a container due to execution with unnecessary privileges.
- 8.8 High severity
InfoSphere Information Server: Improper Neutralization of Special Elements used in an OS Command
IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
- 7.6 High severity
InfoSphere Information Server: Improper Neutralization of Special Elements used in an SQL Command
IBM InfoSphere Information Server 11.7 vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- 7.5 High severity
InfoSphere Information Server: Allocation of Resources Without Limits or Throttling
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.
- 7.5 High severity
InfoSphere Information Server: Improper Limitation of a Pathname to a Restricted Directory
IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
- 9.8 Critical severity
InfoSphere Information Server: Improper Neutralization of Special Elements used in an SQL Command
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. IBM X-Force ID: 297719.
- 8.8 High severity
InfoSphere Information Server: Cross-Site Request Forgery
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 289234.
- 7.5 High severity
IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of…
IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161.
- 8.8 High severity
InfoSphere Information Server: Cross-Site Request Forgery
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 260585.
- 8.8 High severity
InfoSphere Information Server: Cross-Site Request Forgery
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 245400.
- 8.8 High severity
InfoSphere Information Server: Improper Neutralization of Formula Elements in a CSV File
IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 244368.
- 9.8 Critical severity
InfoSphere Information Server: Deserialization of Untrusted Data
IBM InfoSphere Information Server 11.7 is affected by a remote code execution vulnerability due to insecure deserialization in an RMI service. IBM X-Force ID: 255285.
- 9.8 Critical severity
InfoSphere Information Server: Improper Neutralization of Special Elements used in an SQL Command
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 243163.
- 7.5 High severity
Java: Use of a Broken or Risky Cryptographic Algorithm
IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.
- 7.5 High severity
InfoSphere Information Server: Improper Limitation of a Pathname to a Restricted Directory
IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 2463
- 9.8 Critical severity
InfoSphere DataStage: Improper Neutralization of Special Elements used in a Command
IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements. IBM X-Force ID: 236687.
- 9.1 Critical severity
IBM InfoSphere Information Server: Improper Restriction of XML External Entity Reference
"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 236
- 7.8 High severity
IBM InfoSphere Information Server: Improper Neutralization of Special Elements used in an OS Command
"IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-"Force ID: 231361.
- 8.8 High severity
IBM InfoSphere Information Server: Cross-Site Request Forgery
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a "user that the website trusts. IBM X-Force ID: 227295.
- 9.8 Critical severity
IBM InfoSphere Information Server: Improper Neutralization of Formula Elements in a CSV File
"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 223598."
- 7.5 High severity
InfoSphere Information Server: Generation of Error Message Containing Sensitive Information
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. IBM X-Force ID: 231
- 9.8 Critical severity
InfoSphere Information Server: Improper Neutralization of Special Elements used in an SQL Command
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
- 7.8 High severity
InfoSphere Information Server: Improper Neutralization of Special Elements used in an OS Command
IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.