CVE-2024-22348

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...

CVE-2024-22347

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2024-22349 IBM UrbanCode Velocity information disclosure

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system...

CVE-2024-22349

CVE-2024-22349 affects IBM UrbanCode Velocity 4.0.0–4.0.25 and IBM DevOps Velocity 5.0.0, where web pages can be stored locally and read by another user on the system. The underlying issue is a local- reading exposure (no exploit details provided in the supplied docs). IBM’s advisory notes remedi...

CVE-2024-22349 IBM UrbanCode Velocity information disclosure

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system...

CVE-2024-22347 IBM UrbanCode Velocity information disclosure

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2024-22347 IBM UrbanCode Velocity information disclosure

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2024-22347

CVE-2024-22347 (IBM UrbanCode Velocity / IBM DevOps Velocity) affects IBM UrbanCode Velocity 4.0.0 – 4.0.25 and IBM DevOps Velocity 5.0.0. The vulnerability stems from the use of weaker-than-expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. ...

CVE-2024-22348 IBM UrbanCode Velocity cross-origin resource sharing

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...

CVE-2024-22348 IBM UrbanCode Velocity cross-origin resource sharing

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...

CVE-2024-22348

CVE-2024-22348 concerns IBM UrbanCode Velocity and IBM DevOps Velocity. According to the primary entry and corroborating Red Hat/IBM security notes, the vulnerability stems from Cross‑Origin Resource Sharing (CORS) configurations that do not restrict the domain name to trusted origins. Affected p...

CVE-2024-22347: Use of a Broken or Risky Cryptographic Algorithm

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2024-22349: Use of Web Browser Cache Containing Sensitive Information

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system...

CVE-2024-22348: Permissive Cross-domain Policy with Untrusted Domains

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains...

Security Bulletin: Vulnerability in d3-color affects IBM UrbanCode Velocity . WS-2022-0322

Summary WS-2022-0322 The d3-color module prior to 3.1.0 which Velocity was using is susceptible to a regular expression denial of service attack. Vulnerability Details IBM X-Force ID: 212233 DESCRIPTION: d3-color is vulnerable to a denial of service, caused by improper input validation. By sendin...

Security Bulletin: IBM UrbanCode Velocity CVE-2021-44228, Apache Log4j

Summary IBM UrbanCode Velocity is vulnerable to CVE-2021-44228, Apache Log4j in the web client. The other IBM UrbanCode Velocity services are built upon JavaScript which use Log4js and based on current knowledge and analysis, we believe are not affected. Vulnerability Details CVEID: CVE-2021-4422...