Vendor CVEs

IBM

All CVEs

8,271 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2021-20341	IBM Cloud Pak for Multicloud Management	Med	0.35	5.3	0.01	Mar 9, 2021	IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further attacks against the system. IBM X-Force ID: 194513.
CVE-2021-20351	IBM Engineering products	Med	0.35	5.4	0.01	Mar 4, 2021	IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2021-20350	IBM Engineering products	Med	0.35	5.4	0.01	Mar 4, 2021	IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2021-20340	IBM Engineering products	Med	0.35	5.4	0.01	Mar 4, 2021	IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4975	IBM Engineering products	Med	0.35	5.4	0.01	Mar 4, 2021	IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4866	IBM Engineering products	Med	0.35	5.4	0.01	Mar 4, 2021	IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4863	IBM Engineering products	Med	0.35	5.4	0.01	Mar 4, 2021	IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2020-4857	IBM Engineering products	Med	0.35	5.4	0.01	Mar 4, 2021	IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2020-4856	IBM Engineering products	Med	0.35	5.4	0.01	Mar 4, 2021	IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2021-20446	IBM Maximo for Civil Infrastructure	Med	0.35	5.4	0.01	Feb 18, 2021	IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4933	IBM Jazz Reporting Service	Med	0.35	5.4	0.01	Feb 18, 2021	IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4954	IBM Spectrum Protect Operations Center	Med	0.35	5.4	0.01	Feb 15, 2021	IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an…
CVE-2021-20410	IBM Security Verify Information Queue	Med	0.35	5.3	0.01	Feb 12, 2021	IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the middle techniques. IBM X-Force ID: 198190.
CVE-2021-20407	IBM Security Verify Information Queue	Med	0.35	5.3	0.01	Feb 12, 2021	IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system. IBM X-Force ID: 196185.
CVE-2021-20404	IBM Security Verify Information Queue	Med	0.35	5.3	0.01	Feb 11, 2021	IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user on the network to cause a denial of service due to an invalid cookie value that could prevent future logins. IBM X-Force ID: 196078.
CVE-2020-4768	IBM Case Manager	Med	0.35	5.4	0.00	Feb 11, 2021	IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2020-4995	IBM Security Identity Governance And Intelligence	Med	0.35	5.3	0.01	Feb 9, 2021	IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from another users' session. IBM X-Force ID: 192912.
CVE-2020-4825	IBM API Connect	Med	0.35	5.4	0.01	Feb 4, 2021	IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
CVE-2021-20357	IBM Jazz Foundation Products	Med	0.35	5.4	0.01	Jan 27, 2021	IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4865	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 27, 2021	IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4855	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 27, 2021	IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4547	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 27, 2021	IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further…
CVE-2020-4524	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 27, 2021	IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4815	IBM Cloud Pak for Security	Med	0.35	5.3	0.01	Jan 27, 2021	IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system.
CVE-2020-4628	IBM Cloud Pak for Security	Med	0.35	5.3	0.01	Jan 27, 2021	IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.
CVE-2020-4873	IBM IBM Planning Analytics	Med	0.35	5.3	0.01	Jan 19, 2021	IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836.
CVE-2020-4600	IBM Security Guardium Insights	Med	0.35	5.3	0.01	Jan 13, 2021	IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184832.
CVE-2020-4599	IBM Security Guardium Insights	Med	0.35	5.3	0.01	Jan 13, 2021	IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184824.
CVE-2020-4838	IBM API Connect	Med	0.35	5.4	0.01	Jan 12, 2021	IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2020-4733	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4697	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4691	IBM Jazz Foundation Products	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-5022	IBM Spectrum Protect	Med	0.35	5.3	0.01	Jan 8, 2021	IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining information they are not authorized to access. IBM X-Force ID: 193658.
CVE-2020-4666	IBM Engineering Requirements Quality Assistant On-Premises	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4664	IBM Engineering Requirements Quality Assistant On-Premises	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4663	IBM Engineering Requirements Quality Assistant On-Premises	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4897	IBM Emptoris Spend Analysis	Med	0.35	5.3	0.02	Jan 7, 2021	IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against…
CVE-2020-4895	IBM Emptoris Strategic Supply Management	Med	0.35	5.4	0.01	Jan 7, 2021	IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
CVE-2020-4892	IBM Emptoris Contract Management	Med	0.35	5.4	0.01	Jan 7, 2021	IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4336	IBM Websphere Extreme Scale	Med	0.35	5.3	0.01	Jan 6, 2021	IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 177932.
CVE-2020-4761	IBM Sterling B2B Integrator Standard Edition	Med	0.35	5.3	0.01	Jan 5, 2021	IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2020-4794	IBM Business Process Manager	Med	0.35	5.4	0.01	Dec 21, 2020	IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization…
CVE-2020-4555	IBM Financial Transaction Manager	Med	0.35	5.4	0.01	Dec 21, 2020	IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 183328.
CVE-2020-4845	IBM Security Key Lifecycle Manager	Med	0.35	5.4	0.01	Dec 17, 2020	IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2020-4908	IBM Financial Transaction Manager for SWIFT Services for Multiplatforms	Med	0.35	5.3	0.01	Dec 16, 2020	IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This information could be used in further attacks against the system.
CVE-2020-4907	IBM Financial Transaction Manager for SWIFT Services for Multiplatforms	Med	0.35	5.3	0.01	Dec 16, 2020	IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVE-2020-4625	IBM Cloud Pak for Security	Med	0.35	5.3	0.01	Nov 30, 2020	IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.
CVE-2020-4624	IBM Cloud Pak for Security	Med	0.35	5.3	0.01	Nov 30, 2020	IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to decrypt sensitive information.
CVE-2020-4771	IBM Spectrum Protect Operations Center	Med	0.35	5.3	0.02	Nov 23, 2020	IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitive information, caused by improper authentication of a websocket endpoint. By using known tools to subscribe to the websocket event stream,…
CVE-2020-4718	IBM Jazz Reporting Service	Med	0.35	5.4	0.01	Nov 19, 2020	IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within…

CVE-2021-20341MedMar 9, 2021
IBM
Cloud Pak for Multicloud Management
risk 0.35cvss 5.3epss 0.01
IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further attacks against the system. IBM X-Force ID: 194513.
CVE-2021-20351MedMar 4, 2021
IBM
Engineering products
risk 0.35cvss 5.4epss 0.01
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2021-20350MedMar 4, 2021
IBM
Engineering products
risk 0.35cvss 5.4epss 0.01
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2021-20340MedMar 4, 2021
IBM
Engineering products
risk 0.35cvss 5.4epss 0.01
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4975MedMar 4, 2021
IBM
Engineering products
risk 0.35cvss 5.4epss 0.01
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4866MedMar 4, 2021
IBM
Engineering products
risk 0.35cvss 5.4epss 0.01
IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4863MedMar 4, 2021
IBM
Engineering products
risk 0.35cvss 5.4epss 0.01
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2020-4857MedMar 4, 2021
IBM
Engineering products
risk 0.35cvss 5.4epss 0.01
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2020-4856MedMar 4, 2021
IBM
Engineering products
risk 0.35cvss 5.4epss 0.01
IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2021-20446MedFeb 18, 2021
IBM
Maximo for Civil Infrastructure
risk 0.35cvss 5.4epss 0.01
IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4933MedFeb 18, 2021
IBM
Jazz Reporting Service
risk 0.35cvss 5.4epss 0.01
IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4954MedFeb 15, 2021
IBM
Spectrum Protect Operations Center
risk 0.35cvss 5.4epss 0.01
IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an…
CVE-2021-20410MedFeb 12, 2021
IBM
Security Verify Information Queue
risk 0.35cvss 5.3epss 0.01
IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the middle techniques. IBM X-Force ID: 198190.
CVE-2021-20407MedFeb 12, 2021
IBM
Security Verify Information Queue
risk 0.35cvss 5.3epss 0.01
IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system. IBM X-Force ID: 196185.
CVE-2021-20404MedFeb 11, 2021
IBM
Security Verify Information Queue
risk 0.35cvss 5.3epss 0.01
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user on the network to cause a denial of service due to an invalid cookie value that could prevent future logins. IBM X-Force ID: 196078.
CVE-2020-4768MedFeb 11, 2021
IBM
Case Manager
risk 0.35cvss 5.4epss 0.00
IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
CVE-2020-4995MedFeb 9, 2021
IBM
Security Identity Governance And Intelligence
risk 0.35cvss 5.3epss 0.01
IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from another users' session. IBM X-Force ID: 192912.
CVE-2020-4825MedFeb 4, 2021
IBM
API Connect
risk 0.35cvss 5.4epss 0.01
IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
CVE-2021-20357MedJan 27, 2021
IBM
Jazz Foundation Products
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4865MedJan 27, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4855MedJan 27, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4547MedJan 27, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further…
CVE-2020-4524MedJan 27, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4815MedJan 27, 2021
IBM
Cloud Pak for Security
risk 0.35cvss 5.3epss 0.01
IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system.
CVE-2020-4628MedJan 27, 2021
IBM
Cloud Pak for Security
risk 0.35cvss 5.3epss 0.01
IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.
CVE-2020-4873MedJan 19, 2021
IBM
IBM Planning Analytics
risk 0.35cvss 5.3epss 0.01
IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836.
CVE-2020-4600MedJan 13, 2021
IBM
Security Guardium Insights
risk 0.35cvss 5.3epss 0.01
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184832.
CVE-2020-4599MedJan 13, 2021
IBM
Security Guardium Insights
risk 0.35cvss 5.3epss 0.01
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184824.
CVE-2020-4838MedJan 12, 2021
IBM
API Connect
risk 0.35cvss 5.4epss 0.01
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2020-4733MedJan 8, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4697MedJan 8, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4691MedJan 8, 2021
IBM
Jazz Foundation Products
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-5022MedJan 8, 2021
IBM
Spectrum Protect
risk 0.35cvss 5.3epss 0.01
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining information they are not authorized to access. IBM X-Force ID: 193658.
CVE-2020-4666MedJan 8, 2021
IBM
Engineering Requirements Quality Assistant On-Premises
risk 0.35cvss 5.4epss 0.01
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4664MedJan 8, 2021
IBM
Engineering Requirements Quality Assistant On-Premises
risk 0.35cvss 5.4epss 0.01
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4663MedJan 8, 2021
IBM
Engineering Requirements Quality Assistant On-Premises
risk 0.35cvss 5.4epss 0.01
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4897MedJan 7, 2021
IBM
Emptoris Spend Analysis
risk 0.35cvss 5.3epss 0.02
IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against…
CVE-2020-4895MedJan 7, 2021
IBM
Emptoris Strategic Supply Management
risk 0.35cvss 5.4epss 0.01
IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
CVE-2020-4892MedJan 7, 2021
IBM
Emptoris Contract Management
risk 0.35cvss 5.4epss 0.01
IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4336MedJan 6, 2021
IBM
Websphere Extreme Scale
risk 0.35cvss 5.3epss 0.01
IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 177932.
CVE-2020-4761MedJan 5, 2021
IBM
Sterling B2B Integrator Standard Edition
risk 0.35cvss 5.3epss 0.01
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2020-4794MedDec 21, 2020
IBM
Business Process Manager
risk 0.35cvss 5.4epss 0.01
IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization…
CVE-2020-4555MedDec 21, 2020
IBM
Financial Transaction Manager
risk 0.35cvss 5.4epss 0.01
IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 183328.
CVE-2020-4845MedDec 17, 2020
IBM
Security Key Lifecycle Manager
risk 0.35cvss 5.4epss 0.01
IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2020-4908MedDec 16, 2020
IBM
Financial Transaction Manager for SWIFT Services for Multiplatforms
risk 0.35cvss 5.3epss 0.01
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This information could be used in further attacks against the system.
CVE-2020-4907MedDec 16, 2020
IBM
Financial Transaction Manager for SWIFT Services for Multiplatforms
risk 0.35cvss 5.3epss 0.01
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVE-2020-4625MedNov 30, 2020
IBM
Cloud Pak for Security
risk 0.35cvss 5.3epss 0.01
IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.
CVE-2020-4624MedNov 30, 2020
IBM
Cloud Pak for Security
risk 0.35cvss 5.3epss 0.01
IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to decrypt sensitive information.
CVE-2020-4771MedNov 23, 2020
IBM
Spectrum Protect Operations Center
risk 0.35cvss 5.3epss 0.02
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitive information, caused by improper authentication of a websocket endpoint. By using known tools to subscribe to the websocket event stream,…
CVE-2020-4718MedNov 19, 2020
IBM
Jazz Reporting Service
risk 0.35cvss 5.4epss 0.01
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within…

Page 54 of 166