U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:ibm:infosphere_biginsights:2.0.0.0:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 7 matching records.
Displaying matches 1 through 7.
Vuln ID Summary CVSS Severity
CVE-2014-0905

IBM InfoSphere BigInsights 2.0 through 2.1.2 does not set the secure flag for the LTPA cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Published: August 17, 2014; 7:55:06 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0: 2.9 LOW
CVE-2013-3993

IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.

Published: July 07, 2014; 7:01:28 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0: 3.5 LOW
CVE-2013-3998

CRLF injection vulnerability in the Web Application Enterprise Console in IBM InfoSphere BigInsights 1.1 and 2.x before 2.1 FP2 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Published: March 26, 2014; 6:55:05 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0: 3.5 LOW
CVE-2013-3997

Open redirect vulnerability in the Web Application Enterprise Console in IBM InfoSphere BigInsights 1.1 and 2.x before 2.1 FP2 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Published: March 26, 2014; 6:55:05 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0: 4.9 MEDIUM
CVE-2013-3996

IBM InfoSphere BigInsights 1.1 through 2.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct phishing attacks via a crafted web site.

Published: August 06, 2013; 9:20:17 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0: 4.9 MEDIUM
CVE-2013-3995

Cross-site scripting (XSS) vulnerability in IBM InfoSphere BigInsights 1.1 through 2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Published: August 06, 2013; 9:20:17 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0: 3.5 LOW
CVE-2013-3992

Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere BigInsights 2.0 through 2.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

Published: August 06, 2013; 9:20:12 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0: 6.0 MEDIUM