IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5 10.0.2.x before 10.0.2.7 iFix4 and 10.0.4.x before 10.0.4.0 iFix3 allows remote attackers to execute arbitrary code by including a crafted Flash file.