CVE-2014-4920

The CVE-2014-4920 entry is confirmed to have concrete details in connected documents: the twitter-bootstrap-rails Gem for Rails contains a reflected XSS flaw in the bootstrap_flash helper, caused by inadequate input validation when handling flash messages before rendering to users. This can allow...

CVE-2023-26076

CVE-2023-26076 affects Samsung Exynos mobile chipset/modem family (Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123). The issue is an intra-object overflow in the 5G SM message codec caused by insufficient parameter validation when decoding reserved options, enabl...

CVE-2022-43879

CVE-2022-43879 is an SSRF vulnerability reported by IBM affecting IBM Jazz Team Server (ELM) versions 7.0.1 and 7.0.2, with remediation via iFix022/iFix023. Separate IBM advisories also document the same CVE affecting QRadar WinCollect/WinCollect Agent versions 10.0–10.1.2, with remediation by up...

CVE-2022-4134

Removed by vendor...

CVE-2023-26937

REJECT DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2019-9587. Reason: This record is a reservation duplicate of CVE-2019-9587. Notes: All CVE users should reference CVE-2019-9587 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

CVE-2019-4660

CVE-2019-4660 is an AngularJS client-side template injection vulnerability affecting IBM InfoSphere Information Analyzer and Information Server on Cloud. The issue allows injection of AngularJS template syntax in an internal page request, which can be interpreted by Angular and lead to cross-site...

CVE-2019-4711

CVE-2019-4711 is detailed in IBM’s Security Bulletin for IBM Business Automation Workflow (BAW) 19.0.0.2 with fix JR61324. The issue is an unvalidated TLS certificate import during the registration process to the Resource Registry, allowing a man‑in‑the‑middle attacker to add a signer certificate...

CVE-2018-1966

IBM Security Identity Manager Virtual Appliance (VA) versions 7.0.1–7.0.1.11 are affected by CVE-2018-1966, where error messages disclose sensitive information about the environment, users, or data. This is part of multiple vulnerabilities addressed in the IBM bulletin for ISIM VA, which also lis...

CVE-2019-4504

CVE-2019-4504 affects IBM API Connect (2018 releases). The IBM bulletin notes a vulnerability in API Connect that could inadvertently remove some security patches, potentially exposing the machine to additional attacks. Affected products/versions: IBM API Connect 2018.1–2018.4.1.6. Remediation: f...

CVE-2019-4469

IBM InfoSphere Information Server is confirmed vulnerable to a reflected cross-site scripting (CVE-2019-4469) in the Web UI. Affected products/versions include IBM InfoSphere Information Server (11.3, 11.5, 11.7) and InfoSphere Server on Cloud (11.5, 11.7). The vulnerability allows an attacker to...

CVE-2019-4578

IBM OpenPages GRC Platform (version 8.0) is affected by a cross-site scripting vulnerability (CVE-2019-4578) due to insufficient validation of client-side data. The CNVD entry and IBM security bulletin confirm a stored XSS issue in OpenPages GRC Platform 8.0 with impact on web application context...

CVE-2019-4240

CVE-2019-4240 is a bypass client-side validation vulnerability in IBM Cloud Pak System V2.3.0. An authenticated user with local access could bypass input validation and obtain administrator access due to the lack of server-side validation. IBM has addressed this by upgrading to V2.3.0.1 fixpak fo...

CVE-2019-4432

IBM MQ (including IBM MQ Appliance) is vulnerable to a denial-of-service attack caused by specially crafted messages that can stop queue manager responsiveness and drive high CPU. Affected products and versions include IBM WebSphere MQ v7.1 (7.1.0.0–7.1.0.9), IBM WebSphere MQ v7.5 (7.5.0.0–7.5.0....

CVE-2019-4757

IBM InfoSphere Information Server is vulnerable to cross-site request forgery (CSRF) under CVE-2019-4757. Affected products/versions include IBM InfoSphere Information Server (11.3, 11.5, 11.7) and InfoSphere Information Server on Cloud (11.5, 11.7). The bulletin lists remediation patches and ser...

CVE-2023-0886

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-3411. Reason: This candidate is a reservation duplicate of CVE-2022-3411. Notes: All CVE users should reference CVE-2022-3411 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

CVE-2023-0885

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-0518. Reason: This candidate is a reservation duplicate of CVE-2023-0518. Notes: All CVE users should reference CVE-2023-0518 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

CVE-2023-0884

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-3759. Reason: This candidate is a reservation duplicate of CVE-2022-3759. Notes: All CVE users should reference CVE-2022-3759 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

CVE-2019-4516

CVE-2019-4516 affects IBM Security Key Lifecycle Manager (SKLM) v3.0 through v3.0.0.3 and v3.0.1 through v3.0.1.2. The vulnerability arises from the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Mitigation provided by ...

CVE-2018-1613

CVE-2018-1613 is a confirmed vulnerability in IBM Platform Symphony and IBM Spectrum Symphony involving a vertical authorization bypass in the Symping utility. A local attacker could obtain a privileged token and gain privileges or access highly sensitive data. Affected products/versions: IBM Pla...

CVE-2016-6907

CVE-2016-6907 affects F5 BIG-IP TMM SSL/TLS virtual servers using CBC ciphers, enabling a Vaudenay timing/padding oracle attack to potentially reveal plaintext. vulnerable platforms include BIG-IP on Cavium Nitrox with CBC ciphers (not AES-GCM or RC4); also impacts BIG-IP VE/cloud and specific ha...