Vendor CVEs

IBM

All CVEs

9,452 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2021-20357	IBM Jazz Foundation Products	Med	0.35	5.4	0.01	Jan 27, 2021	IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4865	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 27, 2021	IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4855	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 27, 2021	IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4547	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 27, 2021	IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further…
CVE-2020-4524	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 27, 2021	IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4815	IBM Cloud Pak For Security	Med	0.35	5.3	0.01	Jan 27, 2021	IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system.
CVE-2020-4628	IBM Cloud Pak For Security	Med	0.35	5.3	0.01	Jan 27, 2021	IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.
CVE-2020-4873	IBM Planning Analytics	Med	0.35	5.3	0.01	Jan 19, 2021	IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836.
CVE-2020-4600	IBM Security Guardium Insights	Med	0.35	5.3	0.01	Jan 13, 2021	IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184832.
CVE-2020-4599	IBM Security Guardium Insights	Med	0.35	5.3	0.01	Jan 13, 2021	IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184824.
CVE-2020-4838	IBM API Connect	Med	0.35	5.4	0.01	Jan 12, 2021	IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2020-4733	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4697	IBM Jazz Foundation	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4691	IBM Jazz Foundation Products	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-5022	IBM Spectrum Protect Plus	Med	0.35	5.3	0.01	Jan 8, 2021	IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining information they are not authorized to access. IBM X-Force ID: 193658.
CVE-2020-4666	IBM Engineering Requirements Quality Assistant On Premises	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4664	IBM Engineering Requirements Quality Assistant On Premises	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4663	IBM Engineering Requirements Quality Assistant On Premises	Med	0.35	5.4	0.01	Jan 8, 2021	IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4897	IBM Emptoris Spend Analysis	Med	0.35	5.3	0.02	Jan 7, 2021	IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against…
CVE-2020-4895	IBM Emptoris Strategic Supply Management	Med	0.35	5.4	0.01	Jan 7, 2021	IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
CVE-2020-4892	IBM Emptoris Contract Management	Med	0.35	5.4	0.01	Jan 7, 2021	IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4336	IBM Websphere Extreme Scale	Med	0.35	5.3	0.01	Jan 6, 2021	IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 177932.
CVE-2020-4761	IBM Sterling B2b Integrator	Med	0.35	5.3	0.01	Jan 5, 2021	IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2020-4794	IBM Business Process Manager	Med	0.35	5.4	0.01	Dec 21, 2020	IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization…
CVE-2020-4555	IBM Financial Transaction Manager	Med	0.35	5.4	0.01	Dec 21, 2020	IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 183328.
CVE-2020-4845	IBM Security Key Lifecycle Manager	Med	0.35	5.4	0.01	Dec 17, 2020	IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2020-4908	IBM Financial Transaction Manager for SWIFT Services for Multiplatforms	Med	0.35	5.3	0.01	Dec 16, 2020	IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This information could be used in further attacks against the system.
CVE-2020-4907	IBM Financial Transaction Manager for SWIFT Services for Multiplatforms	Med	0.35	5.3	0.01	Dec 16, 2020	IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVE-2020-4625	IBM Cloud Pak For Security	Med	0.35	5.3	0.01	Nov 30, 2020	IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.
CVE-2020-4624	IBM Cloud Pak For Security	Med	0.35	5.3	0.01	Nov 30, 2020	IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to decrypt sensitive information.
CVE-2020-4771	IBM Spectrum Protect Operations Center	Med	0.35	5.3	0.02	Nov 23, 2020	IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitive information, caused by improper authentication of a websocket endpoint. By using known tools to subscribe to the websocket event stream,…
CVE-2020-4718	IBM Jazz Reporting Service	Med	0.35	5.4	0.01	Nov 19, 2020	IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within…
CVE-2020-4672	IBM Business Automation Workflow	Med	0.35	5.4	0.01	Nov 16, 2020	IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4760	IBM Content Navigator	Med	0.35	5.4	0.01	Nov 10, 2020	IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4704	IBM Content Navigator	Med	0.35	5.4	0.01	Nov 10, 2020	IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2020-4785	IBM App Connect Enterprise Certified Container	Med	0.35	5.4	0.01	Nov 3, 2020	IBM App Connect Enterprise Certified Container 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the…
CVE-2019-4563	IBM Security Directory Server	Med	0.35	5.3	0.01	Oct 29, 2020	IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to…
CVE-2019-4547	IBM Security Directory Server	Med	0.35	5.3	0.01	Oct 29, 2020	IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 165949.
CVE-2020-4755	IBM Spectrum Scale	Med	0.35	5.4	0.01	Oct 20, 2020	IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4564	IBM Sterling B2b Integrator	Med	0.35	5.4	0.01	Oct 20, 2020	IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2020-4395	IBM Security Access Manager Appliance	Med	0.35	5.4	0.01	Oct 14, 2020	IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 179358.
CVE-2020-4741	IBM Infosphere Information Server	Med	0.35	5.4	0.01	Oct 12, 2020	IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2020-4681	IBM Security Guardium	Med	0.35	5.4	0.01	Oct 12, 2020	IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4680	IBM Security Guardium	Med	0.35	5.4	0.01	Oct 12, 2020	IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4780	IBM Curam Social Program Management	Med	0.35	5.3	0.01	Oct 12, 2020	OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158.
CVE-2020-4775	IBM Curam Social Program Management	Med	0.35	5.4	0.01	Oct 12, 2020	A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user's device, restricted to a…
CVE-2020-4774	IBM Curam Social Program Management	Med	0.35	5.4	0.01	Oct 12, 2020	An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal…
CVE-2020-4531	IBM Business Process Manager	Med	0.35	5.3	0.01	Sep 25, 2020	IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further…
CVE-2020-4616	IBM Data Risk Manager	Med	0.35	5.3	0.02	Sep 22, 2020	IBM Data Risk Manager (iDNA) 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 184929.
CVE-2020-4615	IBM Data Risk Manager	Med	0.35	5.4	0.01	Sep 22, 2020	IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…

CVE-2021-20357MedJan 27, 2021
IBM
Jazz Foundation Products
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4865MedJan 27, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4855MedJan 27, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4547MedJan 27, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further…
CVE-2020-4524MedJan 27, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4815MedJan 27, 2021
IBM
Cloud Pak For Security
risk 0.35cvss 5.3epss 0.01
IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system.
CVE-2020-4628MedJan 27, 2021
IBM
Cloud Pak For Security
risk 0.35cvss 5.3epss 0.01
IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.
CVE-2020-4873MedJan 19, 2021
IBM
Planning Analytics
risk 0.35cvss 5.3epss 0.01
IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836.
CVE-2020-4600MedJan 13, 2021
IBM
Security Guardium Insights
risk 0.35cvss 5.3epss 0.01
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184832.
CVE-2020-4599MedJan 13, 2021
IBM
Security Guardium Insights
risk 0.35cvss 5.3epss 0.01
IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184824.
CVE-2020-4838MedJan 12, 2021
IBM
API Connect
risk 0.35cvss 5.4epss 0.01
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2020-4733MedJan 8, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4697MedJan 8, 2021
IBM
Jazz Foundation
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4691MedJan 8, 2021
IBM
Jazz Foundation Products
risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-5022MedJan 8, 2021
IBM
Spectrum Protect Plus
risk 0.35cvss 5.3epss 0.01
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining information they are not authorized to access. IBM X-Force ID: 193658.
CVE-2020-4666MedJan 8, 2021
IBM
Engineering Requirements Quality Assistant On Premises
risk 0.35cvss 5.4epss 0.01
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4664MedJan 8, 2021
IBM
Engineering Requirements Quality Assistant On Premises
risk 0.35cvss 5.4epss 0.01
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4663MedJan 8, 2021
IBM
Engineering Requirements Quality Assistant On Premises
risk 0.35cvss 5.4epss 0.01
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
CVE-2020-4897MedJan 7, 2021
IBM
Emptoris Spend Analysis
risk 0.35cvss 5.3epss 0.02
IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against…
CVE-2020-4895MedJan 7, 2021
IBM
Emptoris Strategic Supply Management
risk 0.35cvss 5.4epss 0.01
IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
CVE-2020-4892MedJan 7, 2021
IBM
Emptoris Contract Management
risk 0.35cvss 5.4epss 0.01
IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4336MedJan 6, 2021
IBM
Websphere Extreme Scale
risk 0.35cvss 5.3epss 0.01
IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 177932.
CVE-2020-4761MedJan 5, 2021
IBM
Sterling B2b Integrator
risk 0.35cvss 5.3epss 0.01
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2020-4794MedDec 21, 2020
IBM
Business Process Manager
risk 0.35cvss 5.4epss 0.01
IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or cuase a denial of service due to iimproper authorization…
CVE-2020-4555MedDec 21, 2020
IBM
Financial Transaction Manager
risk 0.35cvss 5.4epss 0.01
IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 183328.
CVE-2020-4845MedDec 17, 2020
IBM
Security Key Lifecycle Manager
risk 0.35cvss 5.4epss 0.01
IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2020-4908MedDec 16, 2020
IBM
Financial Transaction Manager for SWIFT Services for Multiplatforms
risk 0.35cvss 5.3epss 0.01
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the login dialog. This information could be used in further attacks against the system.
CVE-2020-4907MedDec 16, 2020
IBM
Financial Transaction Manager for SWIFT Services for Multiplatforms
risk 0.35cvss 5.3epss 0.01
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVE-2020-4625MedNov 30, 2020
IBM
Cloud Pak For Security
risk 0.35cvss 5.3epss 0.01
IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.
CVE-2020-4624MedNov 30, 2020
IBM
Cloud Pak For Security
risk 0.35cvss 5.3epss 0.01
IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to decrypt sensitive information.
CVE-2020-4771MedNov 23, 2020
IBM
Spectrum Protect Operations Center
risk 0.35cvss 5.3epss 0.02
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitive information, caused by improper authentication of a websocket endpoint. By using known tools to subscribe to the websocket event stream,…
CVE-2020-4718MedNov 19, 2020
IBM
Jazz Reporting Service
risk 0.35cvss 5.4epss 0.01
IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within…
CVE-2020-4672MedNov 16, 2020
IBM
Business Automation Workflow
risk 0.35cvss 5.4epss 0.01
IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4760MedNov 10, 2020
IBM
Content Navigator
risk 0.35cvss 5.4epss 0.01
IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4704MedNov 10, 2020
IBM
Content Navigator
risk 0.35cvss 5.4epss 0.01
IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2020-4785MedNov 3, 2020
IBM
App Connect Enterprise Certified Container
risk 0.35cvss 5.4epss 0.01
IBM App Connect Enterprise Certified Container 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the…
CVE-2019-4563MedOct 29, 2020
IBM
Security Directory Server
risk 0.35cvss 5.3epss 0.01
IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to…
CVE-2019-4547MedOct 29, 2020
IBM
Security Directory Server
risk 0.35cvss 5.3epss 0.01
IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 165949.
CVE-2020-4755MedOct 20, 2020
IBM
Spectrum Scale
risk 0.35cvss 5.4epss 0.01
IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…
CVE-2020-4564MedOct 20, 2020
IBM
Sterling B2b Integrator
risk 0.35cvss 5.4epss 0.01
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2020-4395MedOct 14, 2020
IBM
Security Access Manager Appliance
risk 0.35cvss 5.4epss 0.01
IBM Security Access Manager Appliance 9.0.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 179358.
CVE-2020-4741MedOct 12, 2020
IBM
Infosphere Information Server
risk 0.35cvss 5.4epss 0.01
IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2020-4681MedOct 12, 2020
IBM
Security Guardium
risk 0.35cvss 5.4epss 0.01
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4680MedOct 12, 2020
IBM
Security Guardium
risk 0.35cvss 5.4epss 0.01
IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
CVE-2020-4780MedOct 12, 2020
IBM
Curam Social Program Management
risk 0.35cvss 5.3epss 0.01
OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158.
CVE-2020-4775MedOct 12, 2020
IBM
Curam Social Program Management
risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user's device, restricted to a…
CVE-2020-4774MedOct 12, 2020
IBM
Curam Social Program Management
risk 0.35cvss 5.4epss 0.01
An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal…
CVE-2020-4531MedSep 25, 2020
IBM
Business Process Manager
risk 0.35cvss 5.3epss 0.01
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further…
CVE-2020-4616MedSep 22, 2020
IBM
Data Risk Manager
risk 0.35cvss 5.3epss 0.02
IBM Data Risk Manager (iDNA) 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 184929.
CVE-2020-4615MedSep 22, 2020
IBM
Data Risk Manager
risk 0.35cvss 5.4epss 0.01
IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…

Page 89 of 190