Security Appscan vulnerabilities | LiveThreat CVE Feed

Product

Security Appscan

by Ibm · last CVE Apr 16, 2018

CVEs

On KEV

8.1

Max CVSS

New 30D

Vulnerabilities27 In the news0 Timeline

Severity mix

Critical 0High 2Medium 3Low 0

Severity

All severities27 Critical0 High2 Medium3 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Security Appscan to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2016-9981	8.1	1%	Aug 2	IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session Affected: 9.0.0.0; 9.0.0.1; 9.0.1.0; 9.0.1.1; 9.0.2.0; 9.0.2.1; +4 more
CVE-2016-6042	7.3	3%	Feb 1	IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory Affected: 9.0.0.0; 9.0.0.1; 9.0.1.0; 9.0.1.1; 9.0.2.0; 9.0.2.1; +2 more
CVE-2016-0288	6.5	2%	Jun 1	IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read arbitrary files via an XML document… Affected: 8.7.0.0; 8.7.0.1; 8.8.0.0; 9.0.0.0; 9.0.0.1; 9.0.1.0; +5 more
CVE-2014-4806	5.5	0%	Aug 29	The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x before 8.7.0.1 iFix 003, 8.8.x before 8.8.0.1 iFix 002, and 9.0.x before 9.0.0.1… Affected: 8.0.0.0 before 8.6.0.2; 8.7.0.0 before 8.7.0.1; 8.8.0.0 before 8.8.0.1; 9.0.0.0 before 9.0.0.1
CVE-2015-1952	5.4	1%	Apr 16	Cross-site scripting (XSS) vulnerability in IBM AppScan Enterprise Edition 9.0.x before 9.0.2 iFix 001 allows remote attackers to inject arbitrary web script or HTML via… Affected: 8.5.0.0; 8.6.0.0; 8.7.0.0; 8.8.0.0; 9.0.0.0; 9.0.1.0; +1 more
CVE-2014-8918	–	1%	Feb 2	IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.5.0.0; 8.5.0.1; +9 more
CVE-2014-6136	–	1%	Feb 2	IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 supports unencrypted sessions, which allows remote attackers to obtain sensitive information by sniffing the network Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.5.0.0; 8.5.0.1; +9 more
CVE-2014-6135	–	1%	Dec 23	IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before… Affected: 8.5; 8.6; 8.7; 8.8; 9.0; 9.0.0.1
CVE-2014-6122	–	2%	Dec 23	IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before… Affected: 8.5; 8.6; 8.7; 8.8; 9.0; 9.0.0.1
CVE-2014-6121	–	1%	Dec 23	Cross-site scripting (XSS) vulnerability in IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0… Affected: 8.5; 8.6; 8.7; 8.8; 9.0; 9.0.0.1
CVE-2014-6119	–	4%	Dec 23	IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before… Affected: 8.5; 8.6; 8.7; 8.8; 9.0; 9.0.0.1
CVE-2014-0904	–	3%	Mar 26	The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remote attackers to execute arbitrary code… Affected: 7.9; 8.0; 8.5; 8.6; 8.7; 8.8
CVE-2013-5453	–	1%	Nov 13	IBM Security AppScan Enterprise 5.6 through 8.7.0.1 allows remote authenticated users to read arbitrary report files by leveraging knowledge of filenames that cannot be easily… Affected: 5.6.0.0; 6.0.0.0; 6.0.1.0; 6.0.2.0; 6.1.1.0; 8.0.0.0; +12 more
CVE-2013-5450	–	1%	Nov 13	IBM Security AppScan Enterprise 8.5 through 8.7.0.1, when Jazz authentication is enabled, allows man-in-the-middle attackers to obtain sensitive information or modify data by… Affected: 8.5.0.0; 8.5.0.1; 8.6.0.0; 8.6.0.1; 8.6.0.2; 8.7.0.0; +1 more
CVE-2013-5430	–	1%	Oct 28	The Jazz Team Server component in IBM Security AppScan Enterprise 8.x before 8.8 has a default username and password, which makes it easier for remote authenticated users to… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.1.0; 8.0.1.1; 8.0.11; +7 more
CVE-2013-3989	–	1%	Oct 25	IBM Security AppScan Enterprise 8.x before 8.8 sends a cleartext AppScan Source database password in a response, which allows remote authenticated users to obtain sensitive… Affected: 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.1.0; 8.0.1.1; 8.0.11; +7 more
CVE-2013-2997	–	0%	Sep 8	IBM Security AppScan Enterprise before 8.7 does not invalidate the session context upon a logout action, which allows remote attackers to hijack sessions by leveraging an… Affected: through 8.6.0.2; 5.6.0.0; 6.0.0.0; 6.0.1.0; 6.0.2.0; 6.1.1.0; +10 more
CVE-2013-0531	–	1%	Sep 8	The SSL implementation in IBM Security AppScan Enterprise before 8.7.0.1 enables cipher suites with weak encryption algorithms, which makes it easier for remote attackers to… Affected: through 8.7.0.0; 5.6.0.0; 6.0.0.0; 6.0.1.0; 6.0.2.0; 6.1.1.0; +11 more
CVE-2013-0532	–	1%	Mar 29	Cross-site request forgery (CSRF) vulnerability in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote… Affected: 5.6.0.0; 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.1.0; 8.0.1.1; +6 more
CVE-2013-0513	–	0%	Mar 29	IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 create a service that lacks " (double quote) characters in the… Affected: 5.6.0.0; 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.1.0; 8.0.1.1; +6 more
CVE-2013-0512	–	1%	Mar 29	Stack-based buffer overflow in the Manual Explore browser plug-in for Firefox in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x… Affected: 5.6.0.0; 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.1.0; 8.0.1.1; +6 more
CVE-2013-0511	–	1%	Mar 29	Multiple SQL injection vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified… Affected: 5.6.0.0; 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.1.0; 8.0.1.1; +6 more
CVE-2013-0510	–	1%	Mar 29	IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends session cookies to a specific external server, which allows man-in-the-middle attackers… Affected: 5.6.0.0; 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.1.0; 8.0.1.1; +6 more
CVE-2013-0474	–	1%	Mar 29	The Manual Explore browser plug-in in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to… Affected: 5.6.0.0; 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.1.0; 8.0.1.1; +6 more
CVE-2013-0473	–	1%	Mar 29	Multiple cross-site scripting (XSS) vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allow… Affected: 5.6.0.0; 8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.1.0; 8.0.1.1; +6 more
CVE-2012-0741	–	1%	Dec 28	IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during use of the Manual Explore Proxy feature, which… Affected: 6.0.0.0; 6.0.1.0; 6.0.2.0; 6.1.1.0; 8.0.0.0; 8.0.0.1; +4 more
CVE-2012-0738	–	1%	Dec 28	IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during scanning, which allows man-in-the-middle… Affected: 6.0.0.0; 6.0.1.0; 6.0.2.0; 6.1.1.0; 8.0.0.0; 8.0.0.1; +4 more