CVE-2019-4628

Affected product: IBM InfoSphere Information Server and Information Server on Cloud (versions 11.3, 11.5, 11.7). Vulnerability: CVE-2019-4628 — Information Disclosure due to incomplete filtering of user input. Root cause / details: Remote attacker could obtain sensitive information through improp...

CVE-2019-4627

IBM InfoSphere Information Server is affected by CVE-2019-4627 (Input validation XSS). The vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Affected products/versions: IBM InfoSphere Information Server (11.3...

CVE-2019-4662

IBM FileNet Content Manager and Case Foundation ACCE contain multiple vulnerabilities including CVE-2019-4662. Affected: FileNet Content Manager and Case Foundation 5.5.2 and 5.5.3. Root cause: authorization tokens or session cookies are not marked as Secure, allowing cookie leakage over insecure...

CVE-2019-4661

IBM FileNet Content Manager and Case Foundation are affected by CVE-2019-4661, where Content could allow an attacker to obtain sensitive information through content sniffing. Affected versions: FileNet Content Manager and Case Foundation 5.5.2 and 5.5.3. Mitigation: install one of the patches lis...

CVE-2019-4587

CVE-2019-4587 affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server). The IBM security bulletin states a local authenticated attacker could gain elevated privileges due to an unquoted search path in sshd_worker.exe, enabling arbitrary code execution with SYSTEM privileges. Aff...

CVE-2019-4584

CVE-2019-4584 is an IBM Db2 local-privilege-escalation vulnerability. IBM Db2 for Linux, UNIX and Windows (including Db2 Connect) is vulnerable to a buffer overflow that could allow an authenticated local attacker to execute arbitrary code on the system as root. The issue affects all fix pack lev...

CVE-2019-4622

CVE-2019-4622 is an IBM cross-site scripting vulnerability affecting multiple IBM Financial Transaction Manager modules (e.g., FTM CPS, FTM ACH, FTM CHK, FTM DP, and Digital Payments variants). The flaw allows embedding arbitrary JavaScript in the Web UI, potentially leading to credential disclos...

CVE-2019-4618

CVE-2019-4618 is confirmed in IBM InfoSphere Metadata Asset Manager (and Information Server on Cloud) with a Stored cross-site scripting vulnerability. Affected products/versions include IBM InfoSphere Metadata Asset Manager: 11.3, 11.5, 11.7 and IBM InfoSphere Information Server on Cloud: 11.5, ...

CVE-2019-4580

CVE-2019-4580 affects IBM Resilient OnPrem versions prior to 35.2. The IBM bulletin shows the vulnerability arises from weaker cryptographic algorithms used by Resilient, enabling potential decryption of highly sensitive information. Affected product versions: IBM Resilient v33.x and v34.x. Remed...

CVE-2019-4532

CVE-2019-4532 affects IBM Resilient OnPrem. The vulnerability exists in IBM Resilient versions 33.x and 34.0 where the platform does not properly limit the number or frequency of interactions with an actor (e.g., password reset requests). This could enable abuse of reset flows. Remediation: upgra...

CVE-2019-4097

CVE-2019-4097 is a spoofing vulnerability in Platform System Manager (PSM) shipped with IBM Cloud Pak System/PureApplication System. An authenticated user could steal or manipulate customer sessions and cookies. Affected product: IBM Cloud Pak System (V2.3.0). CVSS Base score 4.3. Remediation: up...

GitHub: Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api

An incorrect authorization vulnerability was found in GitHub Enterprise Server that allowed GitHub Apps to gain access to and modify most organization-level resources that are not tied to a repository, regardless of granted permissions. This vulnerability affected all versions of GitHub Enterpris...

CVE-2021-22476

IBM WebSphere Application Server Liberty (and Open Liberty) versions 17.0.0.3–22.0.0.9 are cited in the IBM bulletin as affected by CVE-2021-22476, with remediation through upgrading to IBM Watson Explorer 12.0.3.10 components (oneWEX, Analytical, Foundational) and applying the corresponding Fix ...

Ltd. cloud cold chain management system has SQL injection vulnerability

Ltd. is a high-tech company that focuses on people's health, safety and well-being, and is a high-tech enterprise that integrates industrial and personal product development, design, manufacturing and sales to maintain people's health and assist organizations in maintaining the health and safety ...

CVE-2022-3102

CVE-2022-3102 affects the jwcrypto library, where the JWT/JWE handling can allow token substitution that may lead to authentication or authorization bypass. The issue arises from jwcrypto’s ability to auto-detect token types (JWS vs JWE) and, under certain conditions, substitute a signed JWS with...

rayonet.org Cross Site Scripting vulnerability OBB-2938201

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-3227

CVE-2022-3227 corresponds to a Local File Inclusion flaw in the WordPress plugin SearchWP Live Ajax Search (versions

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...

CVE-2022-36056

Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when verification should have failed. First...