CVE-2025-1112: Improper Ownership Management

IBM OpenPages with Watson 8.3 and 9.0 could allow an authenticated user to obtain sensitive information that should only be available to privileged users...

CVE-2025-27367: Client-Side Enforcement of Server-Side Security

IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for GRC Objects when an authenticated user sends a specially crafted payload to the server allowing for data to be saved withou...

CVE-2023-43039: Improper Neutralization of Input During Web Page Generation

IBM OpenPages with Watson 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2024-49783: Generation of Predictable IV with CBC Mode

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data, they could exploit this vulnerability t...

CVE-2024-49784: Use of a Broken or Risky Cryptographic Algorithm

IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values...

CVE-2024-49782: Improper Validation of Certificate with Host Mismatch

IBM OpenPages with Watson 8.3 and 9.0 could allow a remote attacker to spoof mail server identity when using SSL/TLS security. An attacker could exploit this vulnerability to gain access to sensitive information disclosed through email notifications generated by OpenPages or disrupt notification...

CVE-2024-49355: Improper Output Neutralization for Logs

IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature...

CVE-2024-49780: Improper Limitation of a Pathname to a Restricted Directory

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to traverse directories on the system. An attacker with privileges to perform Import Configuration could send a specially crafted http request containing "dot dot" sequences /../ in the file name parameter used in...

CVE-2024-49781: Improper Restriction of XML External Entity Reference

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2024-43196: Improper Following of a Certificate's Chain of Trust

IBM OpenPages with Watson 8.3 and 9.0 application could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to spoof other users' responses...

PT-2025-7428

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The issue allows IBM OpenPages with Watson to write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature. Recommendations For...

PT-2025-7429

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The issue is caused by improper validation and management of authentication cookies, allowing a remote attacker to bypass security restrictions. By modifying the CSRF token and...

PT-2025-7430

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The issue allows a remote attacker to traverse directories on the system. An attacker with privileges to perform Import Configuration could send a specially crafted http request...

PT-2025-7426

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The issue is caused by improper validation of user-supplied input of text fields used to construct workflow email notifications, leading to HTML injection. A remote authenticated...

PT-2025-7427

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The chat feature in IBM OpenPages with Watson enables the application to establish a session when a user logs in and uses the chat. However, the chat session remains active after t...

PT-2025-7413

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The issue allows an authenticated user to manipulate data in the Questionnaires application, enabling them to spoof other users' responses. Recommendations For versions 8.3 and 9.0...

PT-2025-7431

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The issue is related to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory...

PT-2025-7432

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0 Description The issue allows a remote attacker to spoof the mail server identity when using SSL/TLS security. This could be exploited to gain access to sensitive information disclosed through...

CVE-2024-37527: Improper Neutralization of Input During Web Page Generation

IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2024-35117: Cleartext Storage of Sensitive Information

IBM OpenPages with Watson 9.0 may write sensitive information, under specific configurations, in clear text to the system tracing log files that could be obtained by a privileged user...