Vulnerabilities for Algo credit limits (...) - CXSECURITY.COM

Vulnerabilities for 'Algo credit limits'

2014-07-07

CVE-2014-0894

CWE-200

RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows context-dependent attackers to discover database credentials by reading the DbUser and DbPass fields in an XML document.

CVE-2014-0871

CWE-200

RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to obtain potentially sensitive Tomcat stack-trace information via non-printing characters in a cookie to the /classes/ URI, as demonstrated by the \x00 character.

CVE-2014-0870

CWE-79

Multiple cross-site scripting (XSS) vulnerabilities in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to inject arbitrary web script or HTML via (1) the Message parameter to rcore6/main/showerror.jsp, (2) the ButtonsetClass parameter to rcore6/main/buttonset.jsp, (3) the MBName parameter to rcore6/frameset.jsp, (4) the Init parameter to algopds/rcore6/main/browse.jsp, or the (5) Name, (6) StoreName, or (7) STYLESHEET parameter to algopds/rcore6/main/ibrowseheader.jsp.

CVE-2014-0869

CWE-310

The decrypt function in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics does not require a key, which makes it easier for remote attackers to obtain cleartext passwords by sniffing the network and then providing a string argument to this function.

CVE-2014-0868

CWE-20

RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via a crafted XML document, as demonstrated by manipulation of read-only limit data.

CVE-2014-0867

CWE-noinfo

rcore6/main/addcookie.jsp in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to create or modify cookies via the query string.

CVE-2014-0866

CWE-310

RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics sends cleartext credentials over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network.

CVE-2014-0865

CWE-20

RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics relies on client-side input validation, which allows remote authenticated users to bypass intended dual-control restrictions and modify data via crafted serialized objects, as demonstrated by limit manipulations.

CVE-2014-0864

CWE-352

Multiple cross-site request forgery (CSRF) vulnerabilities in Executer in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allow remote attackers to hijack the authentication of arbitrary users for requests that change (1) a deal's currency or (2) a limit via a crafted XML document.

>>> Vendor: IBM 1045 Products

Lotus domino mail server

Lotus domino server

Aix enetwork firewall

Websphere application server

Tivoli opc tracker agent

Netfinity remote control

System data repository

Navio nc browser

Network station manager

Http server ssl module common

Tivoli management framework

Db2 universal database

Websphere plugin

Net.commerce hosting server

Websphere commerce suite

High availability cluster multiprocessing

Informix web datablade

Tivoli secureway policy director

Alphaworks tftp server

Secureway directory

Lotus domino r5

Visualage for java

Tivoli storage manager

Websphere caching proxy server

Secureway firewall

Aix parallel systems support programs

Lotus notes client

Lotus domino web server

Tivoli firewall toolbox

Internet security systems blackice defender

Websphere edge server caching proxy

Informix dynamic server

Informix extended parallel server

Parallel environment

Trading partner interchange

Tivoli directory server

Tivoli access manager for e-business

Tivoli access manager identity manager solution

Tivoli configuration manager

Tivoli configuration manager for atm

Websphere everyplace server

Hardware management console

Rational clearquest

Lotus domino enterprise server

Db2 content manager

Informix dynamic database server

Lotus domino inotes client

Tivoli business systems manager

Network appliance data ontap

Lotus domino web access

Inventory scout

Client security password manager

Informix client sdk

Informix i-connect

Websphere host on-demand

Tivoli identity manager

Filenet p8 application engine

Tivoli provisioning manager os deployment

Tivoli business service manager

Tivoli monitoring express

See all Products for Vendor IBM

Copyright 2024, cxsecurity.com