Vendor CVEs

IBM

All CVEs

8,825 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2020-4170	IBM Security Guardium Insights	Med	0.28	4.3	0.00	Aug 24, 2020	IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174406.
CVE-2020-4687	IBM Content Navigator	Med	0.28	4.3	0.01	Aug 20, 2020	IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force ID: 186679.
CVE-2019-4582	IBM Maximo Asset Management	Med	0.28	4.3	0.01	Aug 13, 2020	IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 167288.
CVE-2020-4410	IBM Jazz Foundation	Med	0.28	4.3	0.01	Aug 4, 2020	IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to send a specially crafted HTTP GET request to read attachments on the server that they should not have access to. IBM X-Force ID: 179539.
CVE-2019-4589	IBM Cognos Analytics	Med	0.28	4.3	0.01	Aug 3, 2020	IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and accessible to a less privileged user. IBM X-Force ID: 167449.
CVE-2020-4319	IBM Mq Appliance	Med	0.28	4.3	0.01	Jul 28, 2020	IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub logic. IBM X-Force ID: 177402.
CVE-2020-4405	IBM Verify Gateway	Med	0.28	4.3	0.01	Jul 27, 2020	IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log files. IBM X-Force ID: 179484.
CVE-2020-4361	IBM Planning Analytics	Med	0.28	4.3	0.01	Jul 20, 2020	IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. IBM X-Force ID: 178766.
CVE-2020-4173	IBM Guardium Activity Insights	Med	0.28	4.3	0.01	Jul 9, 2020	IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be…
CVE-2019-4704	IBM Security Identity Manager Virtual Appliance	Med	0.28	4.3	0.01	Jul 1, 2020	IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie…
CVE-2020-4322	IBM Security Secret Server	Med	0.28	4.3	0.01	Jun 24, 2020	IBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further…
CVE-2020-4357	IBM Spectrum Scale	Med	0.28	4.3	0.01	May 27, 2020	IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178761.
CVE-2020-4365	IBM Websphere Application Server	Med	0.28	4.3	0.01	May 14, 2020	IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 178964.
CVE-2020-4299	IBM Sterling B2B Integrator Standard Edition	Med	0.28	4.3	0.01	May 14, 2020	IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 could expose sensitive information to a user through a specially crafted HTTP request. IBM X-Force ID: 176606.
CVE-2020-4312	IBM Sterling B2b Integrator	Med	0.28	4.3	0.01	May 13, 2020	IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensitive information from a cached web page. IBM X-Force ID: 177089.
CVE-2020-4446	IBM Business Process Manager	Med	0.28	4.3	0.01	May 6, 2020	IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126.
CVE-2019-4288	IBM Maximo Anywhere	Med	0.28	4.3	0.00	Apr 29, 2020	IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to the device. IBM X-Force ID: 160631.
CVE-2019-4286	IBM Maximo Anywhere	Med	0.28	4.3	0.00	Apr 29, 2020	IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to the device. IBM X-Force ID: 160514.
CVE-2020-4329	IBM Websphere Application Server	Med	0.28	4.3	0.01	Apr 28, 2020	IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obtain sensitive information, caused by improper parameter checking. This could be exploited to conduct spoofing attacks. IBM X-Force ID:…
CVE-2019-4729	IBM Cognos Analytics	Med	0.28	4.3	0.02	Apr 27, 2020	IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 172519.
CVE-2020-4260	IBM Urbancode Deploy	Med	0.28	4.3	0.01	Apr 16, 2020	IBM UrbanCode Deploy (UCD) 7.0.5 could allow a user with special permissions to obtain sensitive information via generic processes. IBM X-Force ID: 175639.
CVE-2019-4593	IBM Qradar Security Information And Event Manager	Med	0.28	4.3	0.01	Apr 15, 2020	IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-ForceID: 167743.
CVE-2020-4291	IBM Security Information Queue	Med	0.28	4.3	0.01	Apr 8, 2020	IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176334.
CVE-2020-4282	IBM Security Information Queue	Med	0.28	4.3	0.01	Apr 8, 2020	IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow an authenticated user to perform unauthorized actions by bypassing illegal character restrictions. X-Force ID: 176205.
CVE-2019-4603	IBM Quality Manager	Med	0.28	4.3	0.01	Apr 8, 2020	IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they were created by another user. IBM X-Force ID: 168295.
CVE-2019-4601	IBM Quality Manager	Med	0.28	4.3	0.01	Apr 8, 2020	IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in further attacks against the system.
CVE-2020-4199	IBM Tivoli Netcool\/omnibus	Med	0.28	4.3	0.00	Mar 18, 2020	IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174910.
CVE-2019-4726	IBM Sterling B2b Integrator	Med	0.28	4.3	0.00	Feb 26, 2020	IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172363.
CVE-2019-4745	IBM Maximo Asset Management	Med	0.28	4.3	0.01	Feb 24, 2020	IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information in the URL. IBM X-Force ID: 172883.
CVE-2019-4583	IBM Maximo Asset Management	Med	0.28	4.3	0.01	Feb 20, 2020	IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM X-Force ID: 167289.
CVE-2019-4679	IBM Content Navigator	Med	0.28	4.3	0.01	Jan 28, 2020	IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could be used in further attacks against the system. IBM X-Force ID: 171515.
CVE-2019-4637	IBM Security Secret Server	Med	0.28	4.3	0.01	Jan 28, 2020	IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043.
CVE-2019-4633	IBM Security Secret Server	Med	0.28	4.3	0.01	Jan 28, 2020	IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 170007.
CVE-2019-4655	IBM MQ	Med	0.28	4.3	0.01	Dec 30, 2019	IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticated user to reset client connections due to an error within the Data Conversion routine. IBM X-Force ID: 170966.
CVE-2019-4743	IBM Financial Transaction Manager	Med	0.28	4.3	0.01	Dec 20, 2019	IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to…
CVE-2019-4736	IBM Financial Transaction Manager	Med	0.28	4.3	0.00	Dec 20, 2019	IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172706.
CVE-2019-4231	IBM Cognos Analytics	Med	0.28	4.3	0.01	Dec 20, 2019	IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 159356.
CVE-2019-4095	IBM Cloud Pak System	Med	0.28	4.3	0.00	Dec 10, 2019	IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015.
CVE-2019-4509	IBM Qradar Security Information And Event Manager	Med	0.28	4.3	0.01	Nov 9, 2019	IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obtain sensitive information. IBM X-Force ID: 164430.
CVE-2019-4411	IBM Cognos Controller	Med	0.28	4.3	0.01	Nov 9, 2019	IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658.
CVE-2019-4334	IBM Cognos Analytics	Med	0.28	4.3	0.01	Nov 9, 2019	IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against the system. IBM X-Force ID: 161271.
CVE-2019-4330	IBM Security Guardium Big Data Intelligence	Med	0.28	4.3	0.01	Oct 29, 2019	IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session. IBM X-Force ID: 161210.
CVE-2019-4329	IBM Security Guardium Big Data Intelligence	Med	0.28	4.3	0.01	Oct 29, 2019	IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209.
CVE-2019-4400	IBM Cloud Orchestrator	Med	0.28	4.3	0.01	Oct 25, 2019	IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force…
CVE-2019-4512	IBM Maximo Asset Management	Med	0.28	4.3	0.01	Oct 9, 2019	IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554.
CVE-2019-4442	IBM Websphere Application Server	Med	0.28	4.3	0.02	Sep 17, 2019	IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the system but not content. IBM X-Force ID: 163226.
CVE-2019-4485	IBM Emptoris Spend Analysis	Med	0.28	4.3	0.01	Aug 20, 2019	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4484	IBM Emptoris Spend Analysis	Med	0.28	4.3	0.01	Aug 20, 2019	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4308	IBM Emptoris Spend Analysis	Med	0.28	4.3	0.01	Aug 20, 2019	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.
CVE-2019-4163	IBM StoreIQ	Med	0.28	4.3	0.01	Jul 31, 2019	IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow an authenticated user to obtain sensitive information that a privileged user should only be allowed to view. IBM X-Force ID: 158696.

CVE-2020-4170MedAug 24, 2020
IBM
Security Guardium Insights
risk 0.28cvss 4.3epss 0.00
IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174406.
CVE-2020-4687MedAug 20, 2020
IBM
Content Navigator
risk 0.28cvss 4.3epss 0.01
IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force ID: 186679.
CVE-2019-4582MedAug 13, 2020
IBM
Maximo Asset Management
risk 0.28cvss 4.3epss 0.01
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 167288.
CVE-2020-4410MedAug 4, 2020
IBM
Jazz Foundation
risk 0.28cvss 4.3epss 0.01
IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to send a specially crafted HTTP GET request to read attachments on the server that they should not have access to. IBM X-Force ID: 179539.
CVE-2019-4589MedAug 3, 2020
IBM
Cognos Analytics
risk 0.28cvss 4.3epss 0.01
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and accessible to a less privileged user. IBM X-Force ID: 167449.
CVE-2020-4319MedJul 28, 2020
IBM
Mq Appliance
risk 0.28cvss 4.3epss 0.01
IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub logic. IBM X-Force ID: 177402.
CVE-2020-4405MedJul 27, 2020
IBM
Verify Gateway
risk 0.28cvss 4.3epss 0.01
IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log files. IBM X-Force ID: 179484.
CVE-2020-4361MedJul 20, 2020
IBM
Planning Analytics
risk 0.28cvss 4.3epss 0.01
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. IBM X-Force ID: 178766.
CVE-2020-4173MedJul 9, 2020
IBM
Guardium Activity Insights
risk 0.28cvss 4.3epss 0.01
IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be…
CVE-2019-4704MedJul 1, 2020
IBM
Security Identity Manager Virtual Appliance
risk 0.28cvss 4.3epss 0.01
IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie…
CVE-2020-4322MedJun 24, 2020
IBM
Security Secret Server
risk 0.28cvss 4.3epss 0.01
IBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further…
CVE-2020-4357MedMay 27, 2020
IBM
Spectrum Scale
risk 0.28cvss 4.3epss 0.01
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178761.
CVE-2020-4365MedMay 14, 2020
IBM
Websphere Application Server
risk 0.28cvss 4.3epss 0.01
IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. IBM X-Force ID: 178964.
CVE-2020-4299MedMay 14, 2020
IBM
Sterling B2B Integrator Standard Edition
risk 0.28cvss 4.3epss 0.01
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 could expose sensitive information to a user through a specially crafted HTTP request. IBM X-Force ID: 176606.
CVE-2020-4312MedMay 13, 2020
IBM
Sterling B2b Integrator
risk 0.28cvss 4.3epss 0.01
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensitive information from a cached web page. IBM X-Force ID: 177089.
CVE-2020-4446MedMay 6, 2020
IBM
Business Process Manager
risk 0.28cvss 4.3epss 0.01
IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass security restrictions, caused by the failure to perform insufficient authorization checks. IBM X-Force ID: 181126.
CVE-2019-4288MedApr 29, 2020
IBM
Maximo Anywhere
risk 0.28cvss 4.3epss 0.00
IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to the device. IBM X-Force ID: 160631.
CVE-2019-4286MedApr 29, 2020
IBM
Maximo Anywhere
risk 0.28cvss 4.3epss 0.00
IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to the device. IBM X-Force ID: 160514.
CVE-2020-4329MedApr 28, 2020
IBM
Websphere Application Server
risk 0.28cvss 4.3epss 0.01
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obtain sensitive information, caused by improper parameter checking. This could be exploited to conduct spoofing attacks. IBM X-Force ID:…
CVE-2019-4729MedApr 27, 2020
IBM
Cognos Analytics
risk 0.28cvss 4.3epss 0.02
IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 172519.
CVE-2020-4260MedApr 16, 2020
IBM
Urbancode Deploy
risk 0.28cvss 4.3epss 0.01
IBM UrbanCode Deploy (UCD) 7.0.5 could allow a user with special permissions to obtain sensitive information via generic processes. IBM X-Force ID: 175639.
CVE-2019-4593MedApr 15, 2020
IBM
Qradar Security Information And Event Manager
risk 0.28cvss 4.3epss 0.01
IBM QRadar 7.3.0 to 7.3.3 Patch 2 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-ForceID: 167743.
CVE-2020-4291MedApr 8, 2020
IBM
Security Information Queue
risk 0.28cvss 4.3epss 0.01
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176334.
CVE-2020-4282MedApr 8, 2020
IBM
Security Information Queue
risk 0.28cvss 4.3epss 0.01
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow an authenticated user to perform unauthorized actions by bypassing illegal character restrictions. X-Force ID: 176205.
CVE-2019-4603MedApr 8, 2020
IBM
Quality Manager
risk 0.28cvss 4.3epss 0.01
IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they were created by another user. IBM X-Force ID: 168295.
CVE-2019-4601MedApr 8, 2020
IBM
Quality Manager
risk 0.28cvss 4.3epss 0.01
IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in further attacks against the system.
CVE-2020-4199MedMar 18, 2020
IBM
Tivoli Netcool\/omnibus
risk 0.28cvss 4.3epss 0.00
IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 174910.
CVE-2019-4726MedFeb 26, 2020
IBM
Sterling B2b Integrator
risk 0.28cvss 4.3epss 0.00
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172363.
CVE-2019-4745MedFeb 24, 2020
IBM
Maximo Asset Management
risk 0.28cvss 4.3epss 0.01
IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information in the URL. IBM X-Force ID: 172883.
CVE-2019-4583MedFeb 20, 2020
IBM
Maximo Asset Management
risk 0.28cvss 4.3epss 0.01
IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM X-Force ID: 167289.
CVE-2019-4679MedJan 28, 2020
IBM
Content Navigator
risk 0.28cvss 4.3epss 0.01
IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could be used in further attacks against the system. IBM X-Force ID: 171515.
CVE-2019-4637MedJan 28, 2020
IBM
Security Secret Server
risk 0.28cvss 4.3epss 0.01
IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043.
CVE-2019-4633MedJan 28, 2020
IBM
Security Secret Server
risk 0.28cvss 4.3epss 0.01
IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 170007.
CVE-2019-4655MedDec 30, 2019
IBM
MQ
risk 0.28cvss 4.3epss 0.01
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticated user to reset client connections due to an error within the Data Conversion routine. IBM X-Force ID: 170966.
CVE-2019-4743MedDec 20, 2019
IBM
Financial Transaction Manager
risk 0.28cvss 4.3epss 0.01
IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to…
CVE-2019-4736MedDec 20, 2019
IBM
Financial Transaction Manager
risk 0.28cvss 4.3epss 0.00
IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172706.
CVE-2019-4231MedDec 20, 2019
IBM
Cognos Analytics
risk 0.28cvss 4.3epss 0.01
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 159356.
CVE-2019-4095MedDec 10, 2019
IBM
Cloud Pak System
risk 0.28cvss 4.3epss 0.00
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015.
CVE-2019-4509MedNov 9, 2019
IBM
Qradar Security Information And Event Manager
risk 0.28cvss 4.3epss 0.01
IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obtain sensitive information. IBM X-Force ID: 164430.
CVE-2019-4411MedNov 9, 2019
IBM
Cognos Controller
risk 0.28cvss 4.3epss 0.01
IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658.
CVE-2019-4334MedNov 9, 2019
IBM
Cognos Analytics
risk 0.28cvss 4.3epss 0.01
IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against the system. IBM X-Force ID: 161271.
CVE-2019-4330MedOct 29, 2019
IBM
Security Guardium Big Data Intelligence
risk 0.28cvss 4.3epss 0.01
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session. IBM X-Force ID: 161210.
CVE-2019-4329MedOct 29, 2019
IBM
Security Guardium Big Data Intelligence
risk 0.28cvss 4.3epss 0.01
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209.
CVE-2019-4400MedOct 25, 2019
IBM
Cloud Orchestrator
risk 0.28cvss 4.3epss 0.01
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force…
CVE-2019-4512MedOct 9, 2019
IBM
Maximo Asset Management
risk 0.28cvss 4.3epss 0.01
IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554.
CVE-2019-4442MedSep 17, 2019
IBM
Websphere Application Server
risk 0.28cvss 4.3epss 0.02
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the system but not content. IBM X-Force ID: 163226.
CVE-2019-4485MedAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.28cvss 4.3epss 0.01
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4484MedAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.28cvss 4.3epss 0.01
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4308MedAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.28cvss 4.3epss 0.01
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.
CVE-2019-4163MedJul 31, 2019
IBM
StoreIQ
risk 0.28cvss 4.3epss 0.01
IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow an authenticated user to obtain sensitive information that a privileged user should only be allowed to view. IBM X-Force ID: 158696.

Page 110 of 177