CVE-2020-4898

IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 190989...

CVE-2020-4898

The CVE-2020-4898 issue applies to IBM Emptoris Strategic Supply Management Platform/SSMP 10.1.3.x. The IBM security bulletin documents a weak cryptographic algorithm vulnerability that could allow an attacker to decrypt highly sensitive information (Lucky 13 vulnerability). Affected product vers...

CVE-2020-4896

IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 190987...

CVE-2020-4896

CVE-2020-4896 affects IBM Emptoris Sourcing versions 10.1.0.x, 10.1.1.x, and 10.1.3.x. The root cause is improper input validation that allows manipulating HTTP request headers to perform a web cache poisoning attack. Public references (NVD, CNVD, and IBM bulletin) confirm the vulnerability and a...

CVE-2020-4897

CVE-2020-4897 affects IBM Emptoris Contract Management and IBM Emptoris Spend Analysis. The vulnerability arises from verbose application errors that reveal detailed information in browser responses, enabling an attacker to obtain sensitive data and potentially facilitate subsequent attacks. Affe...

CVE-2020-4897

IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM...

CVE-2020-4893

IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to information disclosure via man in the middle methods. IBM X-Force ID: 190984...

CVE-2020-4895

IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a truste...

CVE-2020-4893

IBM Emptoris Strategic Supply Management Platform (SSMP) versions 10.1.0.x, 10.1.1.x, and 10.1.3.x transmit sensitive information in HTTP GET request parameters, enabling possible information disclosure via MITM. Root cause: GET parameter handling exposes data in transit. CVSS v3.0/3.1 base score...

CVE-2020-4895

IBM Emptoris Sourcing (Emptoris Strategic Supply Management) versions 10.1.0.x, 10.1.1.x and 10.1.3.x are affected by a stored cross-site scripting vulnerability in the Web UI. The issue allows an attacker to embed arbitrary JavaScript in the UI, potentially leading to credential disclosure withi...

CVE-2020-4892

CVE-2020-4892 affects IBM Emptoris Contract Management 10.1.3.x, with a reflected cross-site scripting vulnerability in the Web UI that could allow an attacker to inject arbitrary JavaScript and potentially disclose credentials in a trusted session. The issue is documented in the IBM Security Bul...

CVE-2020-4892

IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190979...

IBM Emptoris Strategic Supply Management 跨站脚本漏洞

IBM Emptoris Strategic Supply Management is a platform for installing and managing the Emptoris suite of products from IBM USA. A cross-site scripting vulnerability exists in IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3, which allows an attacker to alter the intended...

IBM Emptoris Strategic Supply Management 信息泄露漏洞

The IBM Emptoris Strategic Supply Management Platform is the public portal to the Emptoris suite of products. An information disclosure vulnerability exists in IBM Emptoris Strategic Supply Management Platform 10.1.0, 10.1.1, and 10.1.3. The vulnerability stems from the product transmitting...

IBM Emptoris Contract Management 跨站脚本漏洞

IBM Emptoris Contract Management is a web-based contract management software for managing and maintaining legal contracts between parties. A cross-site scripting vulnerability exists in IBM Emptoris Contract Management 10.1.3. An attacker can exploit this vulnerability to embed arbitrary JavaScri...

IBM Emptoris Strategic Supply Management 加密问题漏洞

The IBM Emptoris Strategic Supply Management Platform is the public portal to the Emptoris suite of products. A weak cryptographic algorithm vulnerability exists in IBM Emptoris Strategic Supply Management Platform 10.1.3. An attacker could exploit this vulnerability to decrypt highly sensitive...

IBM Emptoris Sourcing 环境问题漏洞

IBM Emptoris Sourcing helps organizations get affordable pricing and greater value from suppliers by examining factors such as cost, risk and performance in strategic sourcing decisions. A Web cache poisoning vulnerability exists in IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3. The...

Security Bulletin: Stored Cross-Site Scripting Vulnerability Affects IBM Emptoris Sourcing (CVE-2020-4895)

Summary Cross-Site Scripting Stored affects IBM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2020-4895 DESCRIPTION: IBM Emptoris is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended...

Security Bulletin: Web Cache Poisoning Vulnerability Affects IBM Emptoris Sourcing (CVE-2020-4896)

Summary Web cache poisoning vulnerability affects IBM Emptoris Sourcing. Vulnerability Details CVEID: CVE-2020-4896 DESCRIPTION: IBM Emptoris is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. CVSS Base score: 6.5 CVSS Temporal Score: See:...

Security Bulletin: Forced Submit Using GET Vulnerability Affects IBM Emptoris Strategic Supply Management Platform (CVE-2020-4893)

Summary Web form forced to submit using GET method vulnerability affects IBM Emptoris Strategic Supply Management Platform. Vulnerability Details CVEID: CVE-2020-4893 DESCRIPTION: IBM Emptoris transmits sensitive information in HTTP GET request parameters. This may lead to information disclosure...