CVE-2018-10247

The connected IBM bulletins describe multiple Jetty/Jasper vulnerabilities that affect IBM Rational Synergy (7.2.1.x) and Rational Change (5.3.x) deployments using Jetty 8.1.3. Vulnerabilities include session hijacking and HTTP request smuggling, plus information disclosure and DoS across several...

CVE-2020-5028

This CVE (CVE-2020-5028) is documented in IBM’s Security Bulletin for IBM Tivoli/Workload Scheduler. The vulnerability is an XSS issue in the Web UI of IBM Tivoli Workload Scheduler (IBM Workload Scheduler) affecting version 9.3.x and 9.4.x. The root cause is cross-site scripting that could allow...

CVE-2020-4745

IBM FileNet Content Manager is vulnerable to cross-site request forgery via its GraphQL endpoint (CVE-2020-4745). Affected: FileNet Content Manager 5.5.4 and 5.5.5. Root cause: CSRF in GraphQL handling could allow malicious actions from an authenticated user. CVSS Baseline 4.3. Remediation: upgra...

CVE-2016-6063

Summary: CVE-2016-6063 affects IBM Resilient prior to version 28 due to the use of outdated SSH ciphers. Affected versions: IBM Resilient 26.0, 26.1, 26.2, 26.3, 26.4, 27.0, 27.1. Impact: potential vulnerability in SSH communication when outdated ciphers are used. Root cause: default sshd_config ...

CVE-2017-1657

The connected IBM Security Bulletin confirms CVE-2017-1657 affects IBM Resilient, where weaker than expected cryptographic algorithms could allow decrypting highly sensitive information. Affected versions are IBM Resilient 27.0–27.2 and 28.0–28.3. IBM has addressed the issue by updating to versio...

CVE-2016-6064

IBM Resilient stores passwords in clear text, affecting IBM Resilient versions 27.0–28.1. The issue can enable local users with filesystem access to read credentials and potentially escalate privileges or access integrated systems. CVSS Base Score is 6.2 with vector CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S...

CVE-2018-1689

CVE-2018-1689 is an IBM Jazz Foundation cross-site scripting (XSS) vulnerability affecting IBM CLM/Rational products that use Jazz technology. The IBM bulletin enumerates affected suites (e.g., CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM, etc.) and lists CVE-2018-1689 as a vulnerability where ...

CVE-2018-1412

CVE-2018-1412 affects IBM DOORS Next Generation (DNG/RRC) with a cross-site scripting flaw in the Web UI that allows embedding arbitrary JavaScript, potentially leading to credentials disclosure in a trusted session. Affected: Rational DOORS Next Generation 6.0–6.0.5 (note: 6.0.6 is not affected)...

CVE-2019-4251

CVE-2019-4251 is an IBM Rational Quality Manager cross-site scripting vulnerability affecting RQM 6.0–6.0.6.1. An attacker could embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Remediation for 6.0.x is to upgrade to 6.0.6.1 iFix004...

CVE-2021-29876

Summary : CVE-2021-29876 is implicated in IBM Robotic Process Automation with Automation Anywhere 11.0 via a Lucky Thirteen timing attack on CBC-mode TLS, enabling a MITM to potentially obtain plaintext. Affected version : 11.0. Impact : confidentiality risk (C:H) with no server-side integrity im...

CVE-2020-26691

IBM’s bulletin for IBM Rational Build Forge 8.0.x lists CVE-2020-26691 as one of several vulnerabilities affecting Build Forge 8.0–8.0.0.20. The connected document provides remediation: upgrade to IBM Rational Build Forge 8.0.0.21, which includes Apache HTTP Server 2.4.52. The description for CVE...

CVE-2019-4727

IBM InfoSphere Information Server is affected by CVE-2019-4727, a cross-site scripting vulnerability that allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Affected products/versions include InfoSphere Information Server (...

CVE-2020-22346

IBM Spectrum Protect Operations Center (versions 8.1.0.000–8.1.13.x) is vulnerable to CVEs CVE-2022-22348 (reverse tabnabbing) and CVE-2022-22346 (CSRF). Affected versions may allow an attacker to cause tabnabbing or unauthorized actions via CSRF. Remediation: upgrade to 8.1.14. CVSS bases: 4 and...

GSD-2022-1004941 ext4: add reserved GDT blocks check

ext4: add reserved GDT blocks check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.320 by commit 0dc2fca8e4f9ac4a40e8424a10163369cca0cc06...

GSD-2022-1004833 ext4: add reserved GDT blocks check

ext4: add reserved GDT blocks check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.249 by commit b9747263b13e5290ac4d63bec47e38f701303cad...

GSD-2022-1004287 ext4: add reserved GDT blocks check

ext4: add reserved GDT blocks check This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.6 by commit af75c481a2e45e70f62f5942c93695e95bf7bd21...

Denial Of Service(DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

PT-2025-26150

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to KVM: x86/mmu, where the NX bit is treated as valid when using NPT. This issue occurs when the NX huge page mitigation is...

CVE-2019-16742

This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2019-17591

Bolt CMS 3.x contains a CSRF vulnerability (CVE-2019-17591) demonstrated by public exploits targeting Bolt CMS 3.6.10. The exploit describes an authenticated user CSRF payload that posts to /index.php/async/folder/create to perform actions on behalf of the user. Connected sources show CSRF risk i...