CVE-2017-1796

CVE-2017-1796 affects IBM Rational Developer for System z and IBM Developer for z Systems where weaker cryptographic algorithms could allow decrypting sensitive information (CVSS 5.9, vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Affected products/versions include Rational Developer for S...

CVE-2020-4423

CVE-2020-4423 concerns IBM Predictive Maintenance and Quality (PMQ) UI where the SSL session cookie (JSESSIONID) is missing the secure attribute, allowing potential exposure of cookies over HTTPS. Affected PMQ versions: 1.0.x, 2.5.x, 2.0.x. Impact: session/cookie theft risk; remediation is to ena...

CVE-2020-4847

IBM Verify Gateway (IVG) contains CVE-2020-4847: when IVG components make API calls, tenant secrets can be exposed (client API secrets, access tokens, cookies) and used to impersonate a tenant. Base score 7.1. Affected IVG versions: RADIUS 1.0.0; PAM 1.0.0, 1.0.1; WinLogin 1.0.0, 1.0.1. Remediati...

CVE-2019-4534

CVE-2019-4534 is addressed in IBM Resilient OnPrem security bulletin. The issue involves hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. Affected products are IBM Resilient OnPrem v32.x and v33.x. Mitigation is to upgrade to 34.0 or hig...

CVE-2017-1658

IBM Resilient (27.0–27.2 and 28.0–28.3) is affected by CVE-2017-1658, where permissions on a security-critical resource allowed read/modify by unintended actors, potentially leaking internal information via generated source files. The bulletin states the fix is to upgrade to 29.0 or later; there ...

CVE-2016-6067

IBM Resilient is vulnerable to Stored XSS (CVE-2016-6067). All versions prior to 26.3 are affected. The vulnerability allows authenticated users to inject arbitrary JavaScript into the Web UI, potentially exposing credentials within a trusted session. CVSSv3 base score 5.4. Remediation: upgrade o...

CVE-2016-6064

IBM Resilient stores passwords in clear text, affecting IBM Resilient versions 27.0–28.1. The issue can enable local users with filesystem access to read credentials and potentially escalate privileges or access integrated systems. CVSS Base Score is 6.2 with vector CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S...

CVE-2017-1529

CVE-2017-1529 is publicly documented via IBM for Rational DOORS Next Generation with potential for a cross-site scripting (XSS) attack in the Web UI. The IBM bulletin actually references CVE-2018-1529 and affects Rational Requirements Composer 5.0.x (5.0.0–5.0.2) and Rational DOORS Next Generatio...

CVE-2019-4449

IBM Maximo Asset Management is affected by CVE-2019-4449, a privilege-escalation vulnerability exploitable by an authenticated user. The core Maximo Asset Management 7.6 product is affected, with multiple IBM Industry Solutions and IBM Control Desk products also impacted when installed atop an af...

CVE-2021-29876

Summary : CVE-2021-29876 is implicated in IBM Robotic Process Automation with Automation Anywhere 11.0 via a Lucky Thirteen timing attack on CBC-mode TLS, enabling a MITM to potentially obtain plaintext. Affected version : 11.0. Impact : confidentiality risk (C:H) with no server-side integrity im...

CVE-2021-35737

Technical details for CVE-2021-35737 are not provided in the supplied documents. Monitor for updates from official sources.

CVE-2021-44288

Technical details are not publicly available in the provided documents. This CVE entry is reserved; monitor for updates as new information is released.

CVE-2020-26691

IBM’s bulletin for IBM Rational Build Forge 8.0.x lists CVE-2020-26691 as one of several vulnerabilities affecting Build Forge 8.0–8.0.0.20. The connected document provides remediation: upgrade to IBM Rational Build Forge 8.0.0.21, which includes Apache HTTP Server 2.4.52. The description for CVE...

CVE-2011-2036

Technical details for CVE-2011-2036 are not publicly available in the provided documents. Monitor for updates.

CVE-2012-0422

CVE-2012-0422 is acknowledged within IBM advisories as part of the Oracle Java SDK-related fixes shipped with WebSphere-related products. The connected IBM pages describe remediation for other CVEs (CVE-2013-0440, CVE-2013-0443, CVE-2013-0169) and list affected WebSphere SDK versions (8.5.x, 8.0....

CVE-2020-22348

IBM Security Bulletin describes CVE-2020-22348 as part of a set of vulnerabilities in IBM Spectrum Protect Operations Center (8.1.0.000–8.1.13.x) including reverse tabnabbing and CSRF. Affected versions can be remediated by upgrading to 8.1.14 on AIX/Linux/Windows. CVSS scores are provided in the...

CVE-2022-35550

The IBM Security Bulletin for CVE-2022-35550 (linked to CVE-2021-35550 in the bulletin) indicates an information-leak vulnerability in IBM Cloud Pak for Multicloud Management Monitoring where Java SE JSSE usage by multiple components could allow an unauthenticated attacker to obtain sensitive inf...

CVE-2022-36371

CVE-2022-36371 is linked to WordPress My Calendar plugin versions

HICOS 缓冲区错误漏洞

HICOS is a tool from China's MOICA that provides IC card credentials for registration into an operating system. A buffer error vulnerability exists in HICOS due to an insufficiently validated parameter length in its citizen authentication component that could be exploited by an unauthenticated...

etswales.org.uk Cross Site Scripting vulnerability OBB-2822135

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...