CVE-2020-4377

CVE-2020-4377 affects IBM Cognos Analytics 11.0 and 11.1, where XML data processing is vulnerable to an XML External Entity (XXE) injection. The root cause is improper handling of XML entities, enabling a remote attacker to disclose sensitive information or exhaust memory. According to IBM/NVD en...

CVE-2020-4186

CVE-2020-4186 affects IBM Security Guardium 10.5, 10.6, 11.0, and 11.1. A vulnerability in the login page could disclose sensitive information, potentially aiding further attacks. IBM’s bulletin frames this as an information exposure in HTML comments, with a CVSS v3 base score of 5.3 (Network, Lo...

CVE-2020-14533

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce component: Dynamo Application Framework. Supported versions that are affected are 11.1, 11.2 and prior to 11.3.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...

CVE-2020-14535

Vulnerability in the Oracle Commerce Service Center product of Oracle Commerce component: Commerce Service Center. Supported versions that are affected are 11.1, 11.2 and prior to 11.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

Design/Logic Flaw

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce component: Dynamo Application Framework. Supported versions that are affected are 11.1, 11.2 and prior to 11.3.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...

CVE-2020-8190

Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege escalation...

Cross site scripting

Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in Stored Cross-Site Scripting XSS...

CVE-2020-4188

CVE-2020-4188 affects IBM Security Guardium 10.5–11.1 (including 10.6 and 11.1) and is due to using insufficiently random numbers/values in security contexts that rely on unpredictability. The vulnerability’s CVSS data indicate limited confidentiality impact (C:L) with no integrity/availability i...

CVE-2020-4193

IBM Security Guardium 11.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 174857...

CVE-2020-4191

The CVE-2020-4191 issue affects IBM Security Guardium (notably version 11.1 per the primary entry) and is caused by the use of weaker cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The IBM advisory confirms Guardium exposure across multiple releases...

CVE-2020-4193

CVE-2020-4193 affects IBM Security Guardium, specifically versions 10.5, 10.6, 11.0, and 11.1, where an inadequate account lockout setting could allow a remote attacker to brute-force credentials. The IBM Security bulletin documents this as an authentication-restriction vulnerability and provides...

CVE-2020-4183

IBM Security Guardium 11.1 is affected by a Cross‑Site Scripting vulnerability (CVE-2020-4183) that could allow an attacker to inject JavaScript in the Web UI and potentially disclose credentials within a trusted session. The IBM Security Guardium bulletin lists this as CVE-2020-4183 with a CVSS ...

CVE-2020-4307

IBM Security Guardium 11.1 could allow an attacker on the same network to gain access to the Solr dashboard and cause a denial of service attack. IBM X-Force ID: 176997...

CVE-2020-4180

IBM Security Guardium 11.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 174735...

CVE-2020-4177

IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174732...

CVE-2020-4187

CVE-2020-4187 affects IBM Security Guardium 10.5, 10.6, 11.0, and 11.1. The IBM bulletin describes a vulnerability where login-page information disclosure could aid further attacks on the system. The CVSS base score is 5.3 (MEDIUM) with impact on confidentiality (LOW) and no impact on integrity/a...

CVE-2020-4182

IBM Security Guardium is affected by Cross-Site Scripting (CVE-2020-4182). The IBM bulletin lists affected versions: Guardium 10.5, 10.6, 11.0, and 11.1. The vulnerability allows an attacker to inject arbitrary JavaScript into the Web UI, potentially leading to credentials disclosure within a tru...

CVE-2020-4180

IBM Security Guardium is affected by an OS command injection vulnerability (CVE-2020-4180) that could allow a remote authenticated attacker to execute arbitrary commands on the system via a specially crafted request. The IBM bulletin confirms affected product versions (Guardium 10.5, 10.6, 11.0, ...

CVE-2020-4182

IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174738...

CVE-2020-4177

Summary of CVE-2020-4177 (IBM Security Guardium) : The vulnerability stems from hard-coded credentials used for internal data encryption and for inbound/outbound communications. This affects IBM Security Guardium versions including 10.5, 10.6, 11.0, and 11.1. The associated IBM bulletin notes rem...