Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to security bypass due to Apache Shiro (CVE-2022-40664)

Summary IBM Sterling Partner Engagement Manager has addressed a vulnerability that are published by Apache Shiro. Vulnerability Details CVEID:CVE-2022-40664 DESCRIPTION: Apache Shiro could allow a remote attacker to bypass security restrictions. By using RequestDispatcher when forwarding or...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to multiple issues due to IBM® SDK, Java™ Technology Edition ( CVE-2022-21541, CVE-2022-21540 )

Summary IBM Sterling Partner Engagement Manager has addressed all applicable Java SE CVEs published by Oracle as part of their July 2022 Critical Patch Update. Vulnerability Details CVEID:CVE-2022-21541 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to SQL injection attack (CVE-2022-40615)

Summary IBM Sterling Partner Engagement Manager has addressed a SQL injection vulnerability. Vulnerability Details CVEID:CVE-2022-40615 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to denial of service (CVE-2022-34335)

Summary IBM Sterling Partner Engagement Manager has addressed a vulnerablity in the PCM APIs. Vulnerability Details CVEID:CVE-2022-34335 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow a an authenticated user to exhaust server resources which could lead to a denial of service. CV...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable unauthorized privilege escalation due to Spring Security (CVE-2022-31690)

Summary IBM Sterling Partner Engagement Manager has addressed a vulnerablity in Spring Security that allows a remote attacker to gain elevated privileges on the system. Vulnerability Details CVEID:CVE-2022-31690 DESCRIPTION: VMware Tanzu Spring Security could allow a remote attacker to gain...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to denial of service due to sshd-core (CVE-2021-30129)

Summary IBM Sterling Partner Engagement Manager has addressed a vulnerablity in sshd-core. Vulnerability Details CVEID:CVE-2021-30129 DESCRIPTION: Apache Mina SSHD is vulnerable to a denial of service, caused by an OutOfMemory flaw in the SFTP and port forwarding features in sshd-core. By sending...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting due to Apache Tomcat (CVE-2022-34305)

Summary IBM Sterling Partner Engagement Manager has addressed a vulnerability published by Apache Tomcat for cross-site scripting. Vulnerability Details CVEID:CVE-2022-34305 DESCRIPTION: Apache Tomcat is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A...

CVE-2022-34354

IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424...

CVE-2022-34354

IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424...

CVE-2022-34354 IBM Sterling Partner Engagement Manager information disclosure

IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424...

PT-2022-22142 · Ibm · Ibm Sterling Partner Engagement Manager

Name of the Vulnerable Software and Affected Versions: IBM Sterling Partner Engagement Manager version 2.0 Description: The issue allows encrypted storage of client data to be stored locally, which can be read by another user on the system. Recommendations: For IBM Sterling Partner Engagement...

IBM Sterling Partner Engagement Manager 安全漏洞

An information disclosure vulnerability exists in IBM Sterling Partner Engagement Manager version 2.0, an automated management tool from International Business Machines Corporation IBM. The vulnerability stems from inadequate protection of sensitive information and encrypted storage of locally...

IBM Sterling Partner Engagement Manager has an unspecified vulnerability (CNVD-2022-68275)

A security vulnerability in IBM Sterling Partner Engagement Manager version 2.0, an automated management tool from International Business Machines Corporation IBM, stems from a failure to invalidate sessions after logging out, which could allow an authenticated user to impersonate another user on...

CVE-2022-34334

IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 229704...

CVE-2022-34334

Summary: IBM Sterling Partner Engagement Manager (version 2.0) is affected by an authentication/ session management vulnerability that allows an authenticated user to impersonate another user after logout. The issue arises from not invalidating the session, enabling session reuse. Affected produc...

CVE-2022-34334

IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 229704...

IBM Sterling Partner Engagement Manager 授权问题漏洞

A security vulnerability in IBM Sterling Partner Engagement Manager version 2.0, an automated management tool from International Business Machines Corporation IBM, stems from a failure to invalidate sessions after logging out, which could allow an authenticated user to impersonate another user on...

PT-2022-22136 · Ibm · Ibm Sterling Partner Engagement Manager

Name of the Vulnerable Software and Affected Versions: IBM Sterling Partner Engagement Manager version 2.0 Description: The issue allows an authenticated user to impersonate another user on the system because it does not invalidate the session after logout. Recommendations: For IBM Sterling Partn...

CVE-2022-34348

IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 230017...

CVE-2022-34348

IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 230017...