Vendor CVEs

IBM

All CVEs

8,825 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2025-36041	IBM Mq Operator	Med	0.31	4.7	0.00	Jun 15, 2025	IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which…
CVE-2025-25019	IBM Cloud Pak For Security	Med	0.31	4.8	0.00	Jun 3, 2025	IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system.
CVE-2025-2896	IBM Planning Analytics Local	Med	0.31	4.8	0.00	Jun 1, 2025	IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2022-39163	IBM Cognos Controller	Med	0.31	4.7	0.00	Mar 26, 2025	IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.
CVE-2024-45644	IBM Security ReaQta	Med	0.31	4.7	0.00	Mar 19, 2025	IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
CVE-2024-56338	IBM Sterling B2b Integrator	Med	0.31	4.8	0.00	Mar 11, 2025	IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2024-54173	IBM MQ	Med	0.31	4.7	0.00	Feb 28, 2025	IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.
CVE-2024-56463	IBM QRadar SIEM	Med	0.31	4.8	0.00	Feb 14, 2025	IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2024-38318	IBM Aspera Shares	Med	0.31	4.8	0.00	Feb 5, 2025	IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVE-2024-38317	IBM Aspera Shares	Med	0.31	4.8	0.00	Feb 5, 2025	IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2024-47103	IBM Sterling B2b Integrator	Med	0.31	4.8	0.00	Jan 31, 2025	IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2024-40696	IBM Sterling B2b Integrator	Med	0.31	4.8	0.00	Jan 31, 2025	IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2024-28771	IBM Security Directory Integrator	Med	0.31	4.8	0.00	Jan 27, 2025	IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link…
CVE-2024-28770	IBM Security Directory Integrator	Med	0.31	4.8	0.00	Jan 27, 2025	IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link…
CVE-2024-51464	IBM I	Med	0.31	4.3	0.01	Dec 21, 2024	IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to remotely perform operations that the user is not allowed to perform when using…
CVE-2024-45087	IBM Websphere Application Server	Med	0.31	4.8	0.00	Nov 11, 2024	IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2024-45073	IBM Websphere Application Server	Med	0.31	4.8	0.00	Sep 30, 2024	IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2024-41774	IBM Common Licensing	Med	0.31	4.8	0.00	Aug 13, 2024	IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. …
CVE-2022-38382	IBM Cloud Pak For Security	Med	0.31	4.7	0.00	Aug 13, 2024	IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information. IBM X-Force ID: 233672.
CVE-2024-37528	IBM Cloud Pak For Business Automation	Med	0.31	4.8	0.00	Jul 8, 2024	IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary…
CVE-2024-35153	IBM Websphere Application Server	Med	0.31	4.8	0.00	Jun 27, 2024	IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2023-37411	IBM Aspera Faspex	Med	0.31	4.8	0.00	May 28, 2024	IBM Aspera Faspex 5.0.0 through 5.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2023-47714	IBM Sterling File Gateway	Med	0.31	4.8	0.00	Apr 12, 2024	IBM Sterling File Gateway 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2023-45186	IBM Sterling B2b Integrator	Med	0.31	4.8	0.00	Apr 12, 2024	IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2024-27270	IBM Websphere Application Server	Med	0.31	4.7	0.00	Mar 27, 2024	IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576.
CVE-2023-50961	IBM QRadar SIEM	Med	0.31	4.8	0.00	Mar 27, 2024	IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: …
CVE-2022-32754	IBM Security Verify	Med	0.31	4.8	0.00	Mar 22, 2024	IBM Security Verify Directory 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2023-28525	IBM Engineering Requirements Management Doors Web Access	Med	0.31	4.8	0.00	Mar 1, 2024	IBM Engineering Requirements Management 9.7.2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2022-40744	IBM Aspera Faspex	Med	0.31	4.8	0.00	Feb 2, 2024	IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2023-42029	IBM Txseries For Multiplatforms	Med	0.31	4.8	0.00	Nov 3, 2023	IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2023-33840	IBM Security Verify Governance	Med	0.31	4.8	0.00	Oct 23, 2023	IBM Security Verify Governance 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2022-39161	IBM Websphere Application Server	Med	0.31	4.8	0.00	May 3, 2023	IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle…
CVE-2022-22320	IBM QRadar SIEM	Med	0.31	4.8	0.00	May 11, 2022	IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2022-22345	IBM Qradar Security Information And Event Manager	Med	0.31	4.8	0.02	Apr 27, 2022	IBM QRadar 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2021-29780	IBM Resilient OnPrem	Med	0.31	4.7	0.01	Jul 19, 2021	IBM Resilient OnPrem v41.1 of IBM Security SOAR could allow an authenticated user to perform actions that they should not have access to due to improper input validation. IBM X-Force ID: 203085.
CVE-2021-20524	IBM Security Verify Access	Med	0.31	4.8	0.00	Jul 15, 2021	IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4885	IBM Db2	Med	0.31	4.7	0.00	Jun 24, 2021	IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909.
CVE-2020-4956	IBM Spectrum Protect Operations Center	Med	0.31	4.8	0.00	Feb 15, 2021	IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped to a file. By setting a grossly large cache value and dumping that cached value to a file multiple times, a remote…
CVE-2020-4916	IBM Cloud Pak System	Med	0.31	4.8	0.01	Jan 4, 2021	IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4910	IBM Cloud Pak System	Med	0.31	4.8	0.01	Jan 4, 2021	IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4909	IBM Cloud Pak System	Med	0.31	4.8	0.01	Jan 4, 2021	IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4788	IBM Aix	Med	0.31	4.7	0.00	Nov 20, 2020	IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
CVE-2020-4705	IBM Sterling B2b Integrator	Med	0.31	4.8	0.01	Nov 16, 2020	IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading…
CVE-2020-4651	IBM Maximo Spatial Asset Management	Med	0.31	4.8	0.00	Nov 9, 2020	IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186024.
CVE-2020-4679	IBM Security Guardium	Med	0.31	4.8	0.01	Oct 12, 2020	IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4316	IBM Publishing Engine	Med	0.31	4.7	0.01	Jul 16, 2020	IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be…
CVE-2020-4387	IBM Db2	Med	0.31	4.7	0.00	Jul 1, 2020	IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179269.
CVE-2020-4386	IBM Db2	Med	0.31	4.7	0.00	Jul 1, 2020	IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179268.
CVE-2019-4654	IBM Qradar Security Information And Event Manager	Med	0.31	4.8	0.00	Apr 15, 2020	IBM QRadar 7.3.0 to 7.3.3 Patch 2 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. IBM X-ForceID: 170965.
CVE-2019-4106	IBM Websphere Extreme Scale	Med	0.31	4.8	0.01	Sep 30, 2019	IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…

CVE-2025-36041MedJun 15, 2025
IBM
Mq Operator
risk 0.31cvss 4.7epss 0.00
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which…
CVE-2025-25019MedJun 3, 2025
IBM
Cloud Pak For Security
risk 0.31cvss 4.8epss 0.00
IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system.
CVE-2025-2896MedJun 1, 2025
IBM
Planning Analytics Local
risk 0.31cvss 4.8epss 0.00
IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2022-39163MedMar 26, 2025
IBM
Cognos Controller
risk 0.31cvss 4.7epss 0.00
IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.
CVE-2024-45644MedMar 19, 2025
IBM
Security ReaQta
risk 0.31cvss 4.7epss 0.00
IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
CVE-2024-56338MedMar 11, 2025
IBM
Sterling B2b Integrator
risk 0.31cvss 4.8epss 0.00
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2024-54173MedFeb 28, 2025
IBM
MQ
risk 0.31cvss 4.7epss 0.00
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.
CVE-2024-56463MedFeb 14, 2025
IBM
QRadar SIEM
risk 0.31cvss 4.8epss 0.00
IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2024-38318MedFeb 5, 2025
IBM
Aspera Shares
risk 0.31cvss 4.8epss 0.00
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVE-2024-38317MedFeb 5, 2025
IBM
Aspera Shares
risk 0.31cvss 4.8epss 0.00
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2024-47103MedJan 31, 2025
IBM
Sterling B2b Integrator
risk 0.31cvss 4.8epss 0.00
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2024-40696MedJan 31, 2025
IBM
Sterling B2b Integrator
risk 0.31cvss 4.8epss 0.00
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2024-28771MedJan 27, 2025
IBM
Security Directory Integrator
risk 0.31cvss 4.8epss 0.00
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link…
CVE-2024-28770MedJan 27, 2025
IBM
Security Directory Integrator
risk 0.31cvss 4.8epss 0.00
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link…
CVE-2024-51464MedDec 21, 2024
IBM
I
risk 0.31cvss 4.3epss 0.01
IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to remotely perform operations that the user is not allowed to perform when using…
CVE-2024-45087MedNov 11, 2024
IBM
Websphere Application Server
risk 0.31cvss 4.8epss 0.00
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2024-45073MedSep 30, 2024
IBM
Websphere Application Server
risk 0.31cvss 4.8epss 0.00
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2024-41774MedAug 13, 2024
IBM
Common Licensing
risk 0.31cvss 4.8epss 0.00
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. …
CVE-2022-38382MedAug 13, 2024
IBM
Cloud Pak For Security
risk 0.31cvss 4.7epss 0.00
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information. IBM X-Force ID: 233672.
CVE-2024-37528MedJul 8, 2024
IBM
Cloud Pak For Business Automation
risk 0.31cvss 4.8epss 0.00
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary…
CVE-2024-35153MedJun 27, 2024
IBM
Websphere Application Server
risk 0.31cvss 4.8epss 0.00
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2023-37411MedMay 28, 2024
IBM
Aspera Faspex
risk 0.31cvss 4.8epss 0.00
IBM Aspera Faspex 5.0.0 through 5.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2023-47714MedApr 12, 2024
IBM
Sterling File Gateway
risk 0.31cvss 4.8epss 0.00
IBM Sterling File Gateway 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2023-45186MedApr 12, 2024
IBM
Sterling B2b Integrator
risk 0.31cvss 4.8epss 0.00
IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2024-27270MedMar 27, 2024
IBM
Websphere Application Server
risk 0.31cvss 4.7epss 0.00
IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576.
CVE-2023-50961MedMar 27, 2024
IBM
QRadar SIEM
risk 0.31cvss 4.8epss 0.00
IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: …
CVE-2022-32754MedMar 22, 2024
IBM
Security Verify
risk 0.31cvss 4.8epss 0.00
IBM Security Verify Directory 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2023-28525MedMar 1, 2024
IBM
Engineering Requirements Management Doors Web Access
risk 0.31cvss 4.8epss 0.00
IBM Engineering Requirements Management 9.7.2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2022-40744MedFeb 2, 2024
IBM
Aspera Faspex
risk 0.31cvss 4.8epss 0.00
IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2023-42029MedNov 3, 2023
IBM
Txseries For Multiplatforms
risk 0.31cvss 4.8epss 0.00
IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2023-33840MedOct 23, 2023
IBM
Security Verify Governance
risk 0.31cvss 4.8epss 0.00
IBM Security Verify Governance 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2022-39161MedMay 3, 2023
IBM
Websphere Application Server
risk 0.31cvss 4.8epss 0.00
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle…
CVE-2022-22320MedMay 11, 2022
IBM
QRadar SIEM
risk 0.31cvss 4.8epss 0.00
IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2022-22345MedApr 27, 2022
IBM
Qradar Security Information And Event Manager
risk 0.31cvss 4.8epss 0.02
IBM QRadar 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2021-29780MedJul 19, 2021
IBM
Resilient OnPrem
risk 0.31cvss 4.7epss 0.01
IBM Resilient OnPrem v41.1 of IBM Security SOAR could allow an authenticated user to perform actions that they should not have access to due to improper input validation. IBM X-Force ID: 203085.
CVE-2021-20524MedJul 15, 2021
IBM
Security Verify Access
risk 0.31cvss 4.8epss 0.00
IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4885MedJun 24, 2021
IBM
Db2
risk 0.31cvss 4.7epss 0.00
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of Db2 due to a race condition of a symbolic link,. IBM X-Force ID: 190909.
CVE-2020-4956MedFeb 15, 2021
IBM
Spectrum Protect Operations Center
risk 0.31cvss 4.8epss 0.00
IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped to a file. By setting a grossly large cache value and dumping that cached value to a file multiple times, a remote…
CVE-2020-4916MedJan 4, 2021
IBM
Cloud Pak System
risk 0.31cvss 4.8epss 0.01
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4910MedJan 4, 2021
IBM
Cloud Pak System
risk 0.31cvss 4.8epss 0.01
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4909MedJan 4, 2021
IBM
Cloud Pak System
risk 0.31cvss 4.8epss 0.01
IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4788MedNov 20, 2020
IBM
Aix
risk 0.31cvss 4.7epss 0.00
IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
CVE-2020-4705MedNov 16, 2020
IBM
Sterling B2b Integrator
risk 0.31cvss 4.8epss 0.01
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading…
CVE-2020-4651MedNov 9, 2020
IBM
Maximo Spatial Asset Management
risk 0.31cvss 4.8epss 0.00
IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 186024.
CVE-2020-4679MedOct 12, 2020
IBM
Security Guardium
risk 0.31cvss 4.8epss 0.01
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4316MedJul 16, 2020
IBM
Publishing Engine
risk 0.31cvss 4.7epss 0.01
IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be…
CVE-2020-4387MedJul 1, 2020
IBM
Db2
risk 0.31cvss 4.7epss 0.00
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179269.
CVE-2020-4386MedJul 1, 2020
IBM
Db2
risk 0.31cvss 4.7epss 0.00
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179268.
CVE-2019-4654MedApr 15, 2020
IBM
Qradar Security Information And Event Manager
risk 0.31cvss 4.8epss 0.00
IBM QRadar 7.3.0 to 7.3.3 Patch 2 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. IBM X-ForceID: 170965.
CVE-2019-4106MedSep 30, 2019
IBM
Websphere Extreme Scale
risk 0.31cvss 4.8epss 0.01
IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…

Page 101 of 177