Vendor CVEs

IBM

All CVEs

8,260 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2019-4637	IBM IBM Security Secret Server	Med	0.28	4.3	0.01	Jan 28, 2020	IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043.
CVE-2019-4633	IBM IBM Security Secret Server	Med	0.28	4.3	0.01	Jan 28, 2020	IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 170007.
CVE-2019-4655	IBM MQ	Med	0.28	4.3	0.01	Dec 30, 2019	IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticated user to reset client connections due to an error within the Data Conversion routine. IBM X-Force ID: 170966.
CVE-2019-4743	IBM Financial Transaction Manager	Med	0.28	4.3	0.01	Dec 20, 2019	IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to…
CVE-2019-4736	IBM Financial Transaction Manager	Med	0.28	4.3	0.00	Dec 20, 2019	IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172706.
CVE-2019-4231	IBM Cognos Analytics	Med	0.28	4.3	0.01	Dec 20, 2019	IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 159356.
CVE-2019-4095	IBM Cloud Pak System	Med	0.28	4.3	0.00	Dec 10, 2019	IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015.
CVE-2019-4509	IBM QRadar SIEM	Med	0.28	4.3	0.01	Nov 9, 2019	IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obtain sensitive information. IBM X-Force ID: 164430.
CVE-2019-4411	IBM Cognos Controller	Med	0.28	4.3	0.01	Nov 9, 2019	IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658.
CVE-2019-4334	IBM Cognos Analytics	Med	0.28	4.3	0.01	Nov 9, 2019	IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against the system. IBM X-Force ID: 161271.
CVE-2019-4330	IBM Security Guardium Big Data Intelligence (SonarG)	Med	0.28	4.3	0.01	Oct 29, 2019	IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session. IBM X-Force ID: 161210.
CVE-2019-4329	IBM Security Guardium Big Data Intelligence (SonarG)	Med	0.28	4.3	0.01	Oct 29, 2019	IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209.
CVE-2019-4400	IBM Cloud Orchestrator	Med	0.28	4.3	0.01	Oct 25, 2019	IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force…
CVE-2019-4512	IBM Maximo Asset Management	Med	0.28	4.3	0.01	Oct 9, 2019	IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554.
CVE-2019-4442	IBM Websphere Application Server	Med	0.28	4.3	0.02	Sep 17, 2019	IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the system but not content. IBM X-Force ID: 163226.
CVE-2019-4485	IBM Emptoris Spend Analysis	Med	0.28	4.3	0.01	Aug 20, 2019	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4484	IBM Emptoris Spend Analysis	Med	0.28	4.3	0.01	Aug 20, 2019	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4308	IBM Emptoris Spend Analysis	Med	0.28	4.3	0.01	Aug 20, 2019	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.
CVE-2019-4163	IBM StoreIQ	Med	0.28	4.3	0.01	Jul 31, 2019	IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow an authenticated user to obtain sensitive information that a privileged user should only be allowed to view. IBM X-Force ID: 158696.
CVE-2019-4194	IBM Jazz For Service Management	Med	0.28	4.3	0.01	Jul 17, 2019	IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete authorized resources. IBM X-Force ID: 159033.
CVE-2019-4263	IBM Content Navigator	Med	0.28	4.3	0.01	Jul 11, 2019	IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 160015.
CVE-2019-4084	IBM Rational Collaborative Lifecycle Management	Med	0.28	4.3	0.01	Jun 27, 2019	IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) could allow an authenticated user to obtain sensitive information from CLM Applications that could be used in further attacks against the system. IBM X-Force ID: 157384.
CVE-2018-1734	IBM Rational Collaborative Lifecycle Management	Med	0.28	4.3	0.01	Jun 27, 2019	IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 discloses sensitive information in error messages that may be used by a malicious user to orchestrate further attacks. IBM X-Force ID: 147838.
CVE-2019-4234	IBM Pureapplication System	Med	0.28	4.3	0.01	Jun 26, 2019	IBM PureApplication System 2.2.3.0 through 2.2.5.3 weakness in the implementation of locking feature in pattern editor. An attacker by intercepting the subsequent requests can bypass business logic to modify the pattern to unlocked state. IBM X-Force ID: 159416.
CVE-2019-4377	IBM Sterling B2b Integrator	Med	0.28	4.3	0.01	Jun 25, 2019	IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803.
CVE-2019-4384	IBM Campaign	Med	0.28	4.3	0.02	Jun 19, 2019	IBM Campaign 9.1.2 and 10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162172.
CVE-2017-1107	IBM Marketing Platform	Med	0.28	4.3	0.01	Jun 19, 2019	IBM Marketing Platform 9.1.0, 9.1.2, 10.0, and 10.1 exposes sensitive information in the headers that could be used by an authenticated attacker in further attacks against the system. IBM X-Force ID: 120906.
CVE-2019-4257	IBM Infosphere Information Server	Med	0.28	4.3	0.01	Jun 6, 2019	IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive information in an error message may be used to conduct further attacks against the system. IBM X-Force ID: 159945.
CVE-2019-4056	IBM Maximo Asset Management	Med	0.28	4.3	0.01	Jun 6, 2019	IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious files. IBM X-Force ID: 156565.
CVE-2018-1790	IBM Financial Transaction Manager for Digital Payments for Multi-Platform	Med	0.28	4.3	0.01	May 10, 2019	IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944.
CVE-2018-2008	IBM Tririga Application Platform	Med	0.28	4.3	0.01	May 7, 2019	IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further attacks against the system. IBM X-Force ID: 155146.
CVE-2018-2001	IBM Curam Social Program Management	Med	0.28	4.3	0.01	May 7, 2019	IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154891.
CVE-2019-4047	IBM Jazz Reporting Service	Med	0.28	4.3	0.01	Apr 29, 2019	IBM Jazz Reporting Service (JRS) 6.0.6 could allow an authenticated user to access the execution log files as a guest user, and obtain the information of the server execution. IBM X-Force ID: 156243.
CVE-2019-4222	IBM Sterling B2B Integrator Standard Edition	Med	0.28	4.3	0.01	Apr 25, 2019	IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without permission. IBM X-Force ID: 159231.
CVE-2019-4045	IBM Business Process Manager	Med	0.28	4.3	0.01	Apr 8, 2019	IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a missing restriction in an API, a client might spoof the last modified by value of a document. IBM X-Force ID: 156241.
CVE-2018-2000	IBM Business Automation Workflow	Med	0.28	4.3	0.01	Apr 8, 2019	IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890.
CVE-2018-1999	IBM Business Automation Workflow	Med	0.28	4.3	0.01	Apr 8, 2019	IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889.
CVE-2018-1997	IBM Business Process Manager	Med	0.28	4.3	0.01	Apr 8, 2019	IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.
CVE-2018-1906	IBM Infosphere Information Server	Med	0.28	4.3	0.02	Apr 2, 2019	IBM InfoSphere Information Server 11.3, 11.5, and 11.7could allow an authenticated user to download code using a specially crafted HTTP request. IBM X-Force ID: 152663.
CVE-2018-1625	IBM Security Privileged Identity Manager	Med	0.28	4.3	0.01	Apr 2, 2019	IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 144410.
CVE-2018-1622	IBM Security Privileged Identity Manager	Med	0.28	4.3	0.01	Apr 2, 2019	IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 144348.
CVE-2018-1929	IBM Rational Engineering Lifecycle Manager	Med	0.28	4.3	0.01	Mar 14, 2019	IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view if he knows the URL link of a the view, and access information that should not be able to see. IBM X-Force ID: 153120.
CVE-2018-1899	IBM Infosphere Information Server	Med	0.28	4.3	0.01	Mar 5, 2019	IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an attacker to change one of the settings related to InfoSphere Business Glossary Anywhere due to improper access control. IBM X-Force ID: 152528.
CVE-2018-1950	IBM Security Identity Governance And Intelligence	Med	0.28	4.3	0.01	Feb 21, 2019	IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID:…
CVE-2018-1949	IBM Security Identity Governance And Intelligence	Med	0.28	4.3	0.01	Feb 21, 2019	IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429.
CVE-2018-1948	IBM Security Identity Governance And Intelligence	Med	0.28	4.3	0.01	Feb 21, 2019	IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a…
CVE-2018-1666	IBM Datapower Gateway	Med	0.28	4.3	0.01	Feb 7, 2019	IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, and 7.7.0.0 through 7.7.1.3 could allow an authenticated user to inject arbitrary messages that would be displayed on the UI. IBM X-Force ID:…
CVE-2018-2026	IBM Financial Transaction Manager	Med	0.28	4.3	0.01	Jan 23, 2019	IBM Financial Transaction Manager 3.2.1 for Digital Payments could allow an authenticated user to obtain a directory listing of internal product files. IBM X-Force ID: 155552.
CVE-2018-1859	IBM API Connect	Med	0.28	4.3	0.01	Jan 4, 2019	IBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user authenticated as an administrator with limited rights to escalate their privileges. IBM X-Force ID: 151258.
CVE-2018-1813	IBM Security Access Manager Appliance	Med	0.28	4.3	0.01	Dec 13, 2018	IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017.

CVE-2019-4637MedJan 28, 2020
IBM
IBM Security Secret Server
risk 0.28cvss 4.3epss 0.01
IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043.
CVE-2019-4633MedJan 28, 2020
IBM
IBM Security Secret Server
risk 0.28cvss 4.3epss 0.01
IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 170007.
CVE-2019-4655MedDec 30, 2019
IBM
MQ
risk 0.28cvss 4.3epss 0.01
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticated user to reset client connections due to an error within the Data Conversion routine. IBM X-Force ID: 170966.
CVE-2019-4743MedDec 20, 2019
IBM
Financial Transaction Manager
risk 0.28cvss 4.3epss 0.01
IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to…
CVE-2019-4736MedDec 20, 2019
IBM
Financial Transaction Manager
risk 0.28cvss 4.3epss 0.00
IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172706.
CVE-2019-4231MedDec 20, 2019
IBM
Cognos Analytics
risk 0.28cvss 4.3epss 0.01
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 159356.
CVE-2019-4095MedDec 10, 2019
IBM
Cloud Pak System
risk 0.28cvss 4.3epss 0.00
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158015.
CVE-2019-4509MedNov 9, 2019
IBM
QRadar SIEM
risk 0.28cvss 4.3epss 0.01
IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obtain sensitive information. IBM X-Force ID: 164430.
CVE-2019-4411MedNov 9, 2019
IBM
Cognos Controller
risk 0.28cvss 4.3epss 0.01
IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identifier names. IBM X-Force ID: 162658.
CVE-2019-4334MedNov 9, 2019
IBM
Cognos Analytics
risk 0.28cvss 4.3epss 0.01
IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against the system. IBM X-Force ID: 161271.
CVE-2019-4330MedOct 29, 2019
IBM
Security Guardium Big Data Intelligence (SonarG)
risk 0.28cvss 4.3epss 0.01
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in plaintext over an HTTP session. IBM X-Force ID: 161210.
CVE-2019-4329MedOct 29, 2019
IBM
Security Guardium Big Data Intelligence (SonarG)
risk 0.28cvss 4.3epss 0.01
IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 161209.
CVE-2019-4400MedOct 25, 2019
IBM
Cloud Orchestrator
risk 0.28cvss 4.3epss 0.01
IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force…
CVE-2019-4512MedOct 9, 2019
IBM
Maximo Asset Management
risk 0.28cvss 4.3epss 0.01
IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164554.
CVE-2019-4442MedSep 17, 2019
IBM
Websphere Application Server
risk 0.28cvss 4.3epss 0.02
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the system but not content. IBM X-Force ID: 163226.
CVE-2019-4485MedAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.28cvss 4.3epss 0.01
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4484MedAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.28cvss 4.3epss 0.01
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4308MedAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.28cvss 4.3epss 0.01
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.
CVE-2019-4163MedJul 31, 2019
IBM
StoreIQ
risk 0.28cvss 4.3epss 0.01
IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow an authenticated user to obtain sensitive information that a privileged user should only be allowed to view. IBM X-Force ID: 158696.
CVE-2019-4194MedJul 17, 2019
IBM
Jazz For Service Management
risk 0.28cvss 4.3epss 0.01
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete authorized resources. IBM X-Force ID: 159033.
CVE-2019-4263MedJul 11, 2019
IBM
Content Navigator
risk 0.28cvss 4.3epss 0.01
IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 160015.
CVE-2019-4084MedJun 27, 2019
IBM
Rational Collaborative Lifecycle Management
risk 0.28cvss 4.3epss 0.01
IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) could allow an authenticated user to obtain sensitive information from CLM Applications that could be used in further attacks against the system. IBM X-Force ID: 157384.
CVE-2018-1734MedJun 27, 2019
IBM
Rational Collaborative Lifecycle Management
risk 0.28cvss 4.3epss 0.01
IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 discloses sensitive information in error messages that may be used by a malicious user to orchestrate further attacks. IBM X-Force ID: 147838.
CVE-2019-4234MedJun 26, 2019
IBM
Pureapplication System
risk 0.28cvss 4.3epss 0.01
IBM PureApplication System 2.2.3.0 through 2.2.5.3 weakness in the implementation of locking feature in pattern editor. An attacker by intercepting the subsequent requests can bypass business logic to modify the pattern to unlocked state. IBM X-Force ID: 159416.
CVE-2019-4377MedJun 25, 2019
IBM
Sterling B2b Integrator
risk 0.28cvss 4.3epss 0.01
IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803.
CVE-2019-4384MedJun 19, 2019
IBM
Campaign
risk 0.28cvss 4.3epss 0.02
IBM Campaign 9.1.2 and 10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162172.
CVE-2017-1107MedJun 19, 2019
IBM
Marketing Platform
risk 0.28cvss 4.3epss 0.01
IBM Marketing Platform 9.1.0, 9.1.2, 10.0, and 10.1 exposes sensitive information in the headers that could be used by an authenticated attacker in further attacks against the system. IBM X-Force ID: 120906.
CVE-2019-4257MedJun 6, 2019
IBM
Infosphere Information Server
risk 0.28cvss 4.3epss 0.01
IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive information in an error message may be used to conduct further attacks against the system. IBM X-Force ID: 159945.
CVE-2019-4056MedJun 6, 2019
IBM
Maximo Asset Management
risk 0.28cvss 4.3epss 0.01
IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious files. IBM X-Force ID: 156565.
CVE-2018-1790MedMay 10, 2019
IBM
Financial Transaction Manager for Digital Payments for Multi-Platform
risk 0.28cvss 4.3epss 0.01
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944.
CVE-2018-2008MedMay 7, 2019
IBM
Tririga Application Platform
risk 0.28cvss 4.3epss 0.01
IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further attacks against the system. IBM X-Force ID: 155146.
CVE-2018-2001MedMay 7, 2019
IBM
Curam Social Program Management
risk 0.28cvss 4.3epss 0.01
IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154891.
CVE-2019-4047MedApr 29, 2019
IBM
Jazz Reporting Service
risk 0.28cvss 4.3epss 0.01
IBM Jazz Reporting Service (JRS) 6.0.6 could allow an authenticated user to access the execution log files as a guest user, and obtain the information of the server execution. IBM X-Force ID: 156243.
CVE-2019-4222MedApr 25, 2019
IBM
Sterling B2B Integrator Standard Edition
risk 0.28cvss 4.3epss 0.01
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without permission. IBM X-Force ID: 159231.
CVE-2019-4045MedApr 8, 2019
IBM
Business Process Manager
risk 0.28cvss 4.3epss 0.01
IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a missing restriction in an API, a client might spoof the last modified by value of a document. IBM X-Force ID: 156241.
CVE-2018-2000MedApr 8, 2019
IBM
Business Automation Workflow
risk 0.28cvss 4.3epss 0.01
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890.
CVE-2018-1999MedApr 8, 2019
IBM
Business Automation Workflow
risk 0.28cvss 4.3epss 0.01
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889.
CVE-2018-1997MedApr 8, 2019
IBM
Business Process Manager
risk 0.28cvss 4.3epss 0.01
IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.
CVE-2018-1906MedApr 2, 2019
IBM
Infosphere Information Server
risk 0.28cvss 4.3epss 0.02
IBM InfoSphere Information Server 11.3, 11.5, and 11.7could allow an authenticated user to download code using a specially crafted HTTP request. IBM X-Force ID: 152663.
CVE-2018-1625MedApr 2, 2019
IBM
Security Privileged Identity Manager
risk 0.28cvss 4.3epss 0.01
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 144410.
CVE-2018-1622MedApr 2, 2019
IBM
Security Privileged Identity Manager
risk 0.28cvss 4.3epss 0.01
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 144348.
CVE-2018-1929MedMar 14, 2019
IBM
Rational Engineering Lifecycle Manager
risk 0.28cvss 4.3epss 0.01
IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view if he knows the URL link of a the view, and access information that should not be able to see. IBM X-Force ID: 153120.
CVE-2018-1899MedMar 5, 2019
IBM
Infosphere Information Server
risk 0.28cvss 4.3epss 0.01
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an attacker to change one of the settings related to InfoSphere Business Glossary Anywhere due to improper access control. IBM X-Force ID: 152528.
CVE-2018-1950MedFeb 21, 2019
IBM
Security Identity Governance And Intelligence
risk 0.28cvss 4.3epss 0.01
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID:…
CVE-2018-1949MedFeb 21, 2019
IBM
Security Identity Governance And Intelligence
risk 0.28cvss 4.3epss 0.01
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429.
CVE-2018-1948MedFeb 21, 2019
IBM
Security Identity Governance And Intelligence
risk 0.28cvss 4.3epss 0.01
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a…
CVE-2018-1666MedFeb 7, 2019
IBM
Datapower Gateway
risk 0.28cvss 4.3epss 0.01
IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, and 7.7.0.0 through 7.7.1.3 could allow an authenticated user to inject arbitrary messages that would be displayed on the UI. IBM X-Force ID:…
CVE-2018-2026MedJan 23, 2019
IBM
Financial Transaction Manager
risk 0.28cvss 4.3epss 0.01
IBM Financial Transaction Manager 3.2.1 for Digital Payments could allow an authenticated user to obtain a directory listing of internal product files. IBM X-Force ID: 155552.
CVE-2018-1859MedJan 4, 2019
IBM
API Connect
risk 0.28cvss 4.3epss 0.01
IBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user authenticated as an administrator with limited rights to escalate their privileges. IBM X-Force ID: 151258.
CVE-2018-1813MedDec 13, 2018
IBM
Security Access Manager Appliance
risk 0.28cvss 4.3epss 0.01
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017.

Page 95 of 166