CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

IBM : Security Vulnerabilities Published In 2006

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2006-6915 DoS 2006-12-31 2008-09-05
4.0
 None Remote Low Single system None None Partial
ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote authenticated users to cause a denial of service (port exhaustion) via unspecified vectors. NOTE: some details were obtained from third party sources.
2 CVE-2006-6914 +Info 2006-12-31 2008-09-05
5.0
 None Remote Low Not required Partial None None
Unspecified vulnerability in ftpd in IBM AIX 5.2.0 and 5.3.0 allows remote attackers to obtain sensitive information, including passwords, via unspecified vectors.
3 CVE-2006-6836 2006-12-31 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in osp-cert in IBM OS/400 V5R3M0 have unspecified impact and attack vectors, related to ASN.1 parsing.
4 CVE-2006-6638 DoS 2006-12-19 2008-09-05
5.0
 None Remote Low Not required None None Partial
IBM DB2 8.1 before FixPak 14 allows remote attackers to cause a denial of service via a crafted SQLJRA packet, which causes a NULL pointer dereference in the sqle_db2ra_as_recvrequest function in DB2ENGN.DLL, a different issue than CVE-2006-4257.
5 CVE-2006-6637 200 +Info 2006-12-19 2011-06-14
5.0
 None Remote Low Not required Partial None None
The Servlet Engine and Web Container in IBM WebSphere Application Server (WAS) before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."
6 CVE-2006-6636 2006-12-19 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server (WAS) before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors.
7 CVE-2006-6607 2006-12-17 2008-09-05
2.7
 None Local Network Low Single system Partial None None
The Java Key Store (JKS) for WebSphere Application Server (WAS) for IBM Tivoli Identity Manager (ITIM) 4.6 places the JKS password in a -Djavax.net.ssl.trustStorePassword command line argument, which allows local users to obtain the password by listing the process or using other methods.
8 CVE-2006-6537 Bypass 2006-12-13 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html.
9 CVE-2006-6309 DoS 2006-12-06 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple array index errors in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 allow remote attackers to read arbitrary memory locations and cause a denial of service (crash) via a large index value in unspecified messages, a different issue than CVE-2006-5855.
10 CVE-2006-6136 2006-11-27 2009-06-17
10.0
 None Remote Low Not required Complete Complete Complete
IBM WebSphere Application Server 6.1.0 before Fix Pack 3 (6.1.0.3) does not perform EAL4 authentication checks at the proper time during "registering of response operation," which has unknown impact and attack vectors.
11 CVE-2006-6135 2006-11-27 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in IBM WebSphere Application Server 6.1.0 before Fix Pack 3 (6.1.0.3) have unknown impact and attack vectors, related to (1) a "Potential security vulnerability" (PK29725) and (2) "Potential security exposure" (PK30831).
12 CVE-2006-5855 DoS Exec Code Overflow 2006-12-06 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple buffer overflows in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in (1) the language field at logon that begins with a 0x18 byte, (2) two unspecified parameters to the SmExecuteWdsfSession function, and (3) the contact field in an open registration message.
13 CVE-2006-5835 2006-11-09 2008-09-05
5.0
 None Remote Low Not required Partial None None
The Notes Remote Procedure Call (NRPC) protocol in IBM Lotus Notes Domino before 6.5.5 FP2 and 7.x before 7.0.2 does not require authentication to perform user lookups, which allows remote attackers to obtain the user ID file.
14 CVE-2006-5818 Exec Code Overflow +Priv 2006-11-08 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Multiple buffer overflows in tunekrnl in IBM Lotus Domino 6.x before 6.5.5 FP2 and 7.x before 7.0.2 allow local users to gain privileges and execute arbitrary code via unspecified vectors.
15 CVE-2006-5664 2006-11-02 2008-09-05
4.6
 None Local Low Not required Partial Partial Partial
The installation script in IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 allows local users to "compromise security" via a symlink attack on temporary files.
16 CVE-2006-5663 +Priv 2006-11-02 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 use insecure permissions for installation scripts, which allows local users to gain privileges by modifying the scripts.
17 CVE-2006-5324 2006-10-17 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
The Web Services Notification (WSN) security component of IBM WebSphere Application Server before 6.1.0.2 allows attackers to obtain unspecified access without supplying a username and password, aka PK28374.
18 CVE-2006-5323 2006-10-17 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Unspecified vulnerability in IBM WebSphere Application Server before 6.1.0.2 has unspecified impact and attack vectors, related to a "possible security exposure," aka PK29360.
19 CVE-2006-5163 2006-10-05 2008-09-05
3.6
 None Local Low Not required None Partial Partial
IBM Informix Dynamic Server 10.UC3RC1 Trial for Linux and possibly other versions creates /tmp/installserver.txt with insecure permissions, which allows local users to append data to arbitrary files via a symlink attack.
20 CVE-2006-5161 2006-10-05 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
IBM Client Security Password Manager stores and distributes saved passwords based upon the title of a website, which allows remote attackers to obtain username and password credentials by changing the title of an HTML page.
21 CVE-2006-5011 Exec Code 2006-09-26 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Untrusted search path vulnerability in snappd in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands via a Trojan horse program, involving the "system subroutine".
22 CVE-2006-5010 Exec Code 2006-09-26 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Untrusted search path vulnerability in acctctl in IBM AIX 5.3.0 allows local users to execute arbitrary commands by modifying the path to point to a malicious mkdir program.
23 CVE-2006-5009 Exec Code Overflow 2006-09-26 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Unspecified vulnerability in xlock in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands and overwrite arbitrary files via unspecified vectors, possibly involving a buffer overflow.
24 CVE-2006-5008 Exec Code 2006-09-26 2008-09-05
10.0
 Admin Remote Low Not required Complete Complete Complete
Unspecified vulnerability in utape in IBM AIX 5.2.0 and 5.3.0 allows attackers to execute arbitrary commands and overwrite arbitrary files via unspecified vectors.
25 CVE-2006-5007 +Priv 2006-09-26 2008-09-05
4.6
 User Local Low Not required Partial Partial Partial
Untrusted search path vulnerability in uucp in IBM AIX 5.2.0 and 5.3.0 allows local users to local users to gain privileges via a Trojan horse program involving uux.
26 CVE-2006-5006 Exec Code Overflow 2006-09-26 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Buffer overflow in cfgmgr in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary code via a long directory path argument.
27 CVE-2006-5005 Exec Code 2006-09-26 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Unspecified vulnerability in bos.net.tcp.client in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands via unspecified vectors involving /etc/slip.login.
28 CVE-2006-5004 2006-09-26 2008-09-05
2.1
 None Local Low Not required None Partial None
Unspecified vulnerability in the rdist command in IBM AIX 5.2.0 and 5.3.0 allows local users to overwrite arbitrary files via unspecified vectors.
29 CVE-2006-5003 Exec Code 2006-09-26 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Unspecified vulnerability in the named8 command in IBM AIX 5.2.0 and 5.3.0 allows local users to execute arbitrary commands via unspecified vectors.
30 CVE-2006-5002 2006-09-26 2008-09-05
5.0
 None Remote Low Not required None Partial None
Unspecified vulnerability in IBM Inventory Scout for AIX 2.2.0.0 through 2.2.0.9 (invscoutClient_VPD_Survey) allows attackers to overwrite arbitrary files via unspecified vectors.
31 CVE-2006-4763 2006-09-13 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
IBM Lotus Domino Web Access (DWA) 7.0.1 does not expire a client's Lightweight Third-Party Authentication token (LtpaToken) upon logout, which allows remote attackers to obtain a user's privileges by intercepting the LtpaToken cookie.
32 CVE-2006-4683 +Info 2006-09-11 2008-09-05
5.0
 None Remote Low Not required Partial None None
IBM Director before 5.10 allows remote attackers to obtain sensitive information from HTTP headers via HTTP TRACE.
33 CVE-2006-4682 DoS 2006-09-11 2008-09-05
5.0
 None Remote Low Not required None None Partial
Multiple unspecified vulnerabilities in IBM Director before 5.10 allow remote attackers to cause a denial of service (crash) via unspecified vectors involving (1) malformed WMI CIM server requests and (2) malformed packets.
34 CVE-2006-4681 Dir. Trav. 2006-09-11 2008-09-05
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in Redirect.bat in IBM Director before 5.10 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the file parameter.
35 CVE-2006-4522 Exec Code 2006-09-01 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Unspecified vulnerability in dtterm in IBM AIX 5.2 and 5.3 allows local users to execute arbitrary code with root privileges via unspecified vectors.
36 CVE-2006-4416 +Priv 2006-08-28 2008-09-05
7.2
 Admin Local Low Not required Complete Complete Complete
Untrusted search path vulnerability in the mkvg command in IBM AIX 5.2 and 5.3 allows local users to gain privileges by modifying the path to point to a malicious (1) chdev, (2) mkboot, (3) varyonvg, or (4) varyoffvg program.
37 CVE-2006-4257 399 DoS 2006-08-21 2011-10-17
4.0
 None Remote Low Single system None None Partial
IBM DB2 Universal Database (UDB) before 8.1 FixPak 13 allows remote authenticated users to cause a denial of service (crash) by (1) sending the first ACCSEC command without an RDBNAM parameter during the CONNECT process, or (2) sending crafted SQLJRA packet, which results in a null dereference.
38 CVE-2006-4254 +Priv 2006-08-21 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Unspecified vulnerability in setlocale in IBM AIX 5.1.0 through 5.3.0 allows local users to gain privileges via unspecified vectors.
39 CVE-2006-4223 +Info 2006-08-18 2008-09-05
5.0
 None Remote Low Not required Partial None None
IBM WebSphere Application Server (WAS) before 6.0.2.13 allows context-dependent attackers to obtain sensitive information via unspecified vectors related to "JSP source code exposure" (PK23475), which occurs when ibm-web-ext.xmi sets fileServingEnabled to true or ExtendedDocumentRoot is used to place a JSP outside a WAR.file; (3) the First Failure Data Capture (ffdc) log file (PK24834); and (4) traces (PK25568), a different issue than CVE-2006-4137.
40 CVE-2006-4222 2006-08-18 2008-09-05
5.0
 None Remote Low Not required Partial None None
Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.0.2.13 have unspecified vectors and impact, including (1) an "authority problem" in ThreadIdentitySupport as identified by PK25199, and "Potential security exposure" issues as identified by (2) PK22747, (3) PK24334, (4) PK25740, and (5) PK26123.
41 CVE-2006-4221 Exec Code Overflow 2006-08-18 2008-09-05
9.3
 Admin Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the IBM Access Support eGatherer ActiveX control before 3.20.0284.0 allows remote attackers to execute arbitrary code via a long filename parameter to the RunEgatherer method.
42 CVE-2006-4137 +Info 2006-08-14 2008-09-05
5.0
 None Remote Low Not required Partial None None
IBM WebSphere Application Server before 6.1.0.1 allows attackers to obtain sensitive information via unspecified vectors related to (1) the log file, (2) "script generated syntax on wsadmin command line," and (3) traces.
43 CVE-2006-4136 264 2006-08-14 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.1.0.1 have unspecified impact and attack vectors involving (1) "SOAP requests and responses", (2) mbean, (3) ThreadIdentitySupport, and possibly others.
44 CVE-2006-3918 XSS 2006-07-27 2012-11-05
4.3
 None Remote Medium Not required None Partial None
http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
45 CVE-2006-3862 Exec Code Overflow 2006-08-08 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.TC5 through 9.40.xC7 and 10.00.TC1 through 10.00.xC3 allows attackers to execute arbitrary code via the SQLIDEBUG environment variable (envariable).
46 CVE-2006-3861 2006-08-08 2008-09-05
4.0
 None Remote Low Single system None Partial None
IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 does not use database creation permissions, which allows remote authenticated users to create arbitrary databases.
47 CVE-2006-3860 Exec Code 2006-08-16 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 allows allows remote authenticated users to execute arbitrary commands via the (1) "SET DEBUG FILE" SQL command, and the (2) start_onpload and (3) dbexp functions.
48 CVE-2006-3859 2006-08-16 2008-09-05
4.0
 None Remote Low Single system None Partial None
IBM Informix Dynamic Server (IDS) allows remote authenticated users to create and overwrite arbitrary files via the (1) LOTOFILE and (2) trl_tracefile_set functions, and the (3) "SET DEBUG FILE" commands.
49 CVE-2006-3858 2006-08-08 2008-09-05
2.1
 None Local Low Not required Partial None None
IBM Informix Dynamic Server (IDS) before 9.40.xC8 and 10.00 before 10.00.xC4 stores passwords in plaintext in shared memory, which allows local users to obtain passwords by reading the memory (product defects 171893, 171894, 173772).
50 CVE-2006-3857 Exec Code Overflow 2006-08-08 2008-09-05
6.5
 User Remote Low Single system Partial Partial Partial
Multiple buffer overflows in IBM Informix Dynamic Server (IDS) before 9.40.TC6 and 10.00 before 10.00.TC3 allow remote authenticated users to execute arbitrary code via (1) the getname function, as used by (a) _sq_remview, (b) _sq_remproc, (c) _sq_remperms, (d) _sq_distfetch, and (e) _sq_dcatalog; and the (2) SET DEBUG FILE, (3) IFX_FILE_TO_FILE, (4) FILETOCLOB, (5) LOTOFILE, and (6) DBINFO functions (product defect IDs 171649, 171367, 171387, 171391, 171906, 172179).
Total number of vulnerabilities : 91   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.