CVE-2016-6068

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM Corporation	UrbanCode Deploy	6.1.0.2; 6.0; 6.0.1; 6.0.1.1; 6.0.1.2; 6.0.1.3; 6.0.1.4; 6.0.1.5; 6.0.1.6; 6.1; 6.1.0.1; 6.1.0.3; 6.0.1.7; 6.0.1.8; 6.1.0.4; 6.1.1; 6.1.1.1; 6.1.1.2; 6.1.1.3; 6.1.1.4

References

http://www.ibm.com/support/docview.wss?uid=swg2C1000229Patch, Vendor Advisory
http://www.securityfocus.com/bid/95290Technical Description, VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg2C1000229Patch, Vendor Advisory
http://www.securityfocus.com/bid/95290Technical Description, VDB Entry

Timeline

Published: Feb 1, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-60725.4IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2016-60775.3IBM Cognos Disclosure Management 10.2 could allow a malicious attacker to execute commands as a lower privileged user that opens a malicious CVE-2016-60797.8IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level priv CVE-2016-60805.3The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker.CVE-2016-608210.0IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An att CVE-2016-60835.3IBM Tivoli Monitoring V6 could allow an unauthenticated user to access SOAP queries that could contain sensitive information. IBM X-Force ID CVE-2016-60846.5IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema request.CVE-2016-60856.5IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers.CVE-2016-60879.8IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key E CVE-2016-60895.5IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to CVE-2016-60909.8IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized a CVE-2016-60926.2IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user.