CVE-2019-4097

CVE-2019-4097 is a spoofing vulnerability in Platform System Manager (PSM) shipped with IBM Cloud Pak System/PureApplication System. An authenticated user could steal or manipulate customer sessions and cookies. Affected product: IBM Cloud Pak System (V2.3.0). CVSS Base score 4.3. Remediation: up...

CVE-2019-4096

CVE-2019-4096 is an IBM Cloud Pak System vulnerability describing inadequate account lockout settings that could allow remote brute-forcing of credentials. IBM Cloud Pak System V2.3.0 is affected; remediation is to upgrade to V2.3.0.1. The IBM security bulletins note the vulnerability is resolved...

CVE-2022-1972

Removed by vendor...

CVE-2022-22403

IBM Aspera Faspex 5.0.0 and 5.0.1 are affected by CVE-2022-22403. The root cause is that authorization tokens or session cookies are not set with the Secure attribute, enabling an attacker to snoop cookie values when a user visits an insecure http link or a compromised site. IBM has addressed thi...

CVE-2022-25704

CVE-2022-25704 is listed in the Android/Qualcomm Bluetooth vulnerability set as a high-severity issue affecting Qualcomm closed-source components. Connected sources indicate it is part of the 2022 Android security update; no exploitation details are provided in the supplied documents. Remediation...

CVE-2022-35958

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-37458. Reason: This candidate is a reservation duplicate of CVE-2022-37458. Notes: All CVE users should reference CVE-2022-37458 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2019-4518

CVE-2019-4518 is associated with IBM Financial Transaction Manager family (Digital Payments, Corporate Payment Services, ACH, Check services). The connected IBM security bulletins confirm a validation weakness where input is not properly validated, potentially allowing an authenticated user to is...

CVE-2020-4275

CVE-2020-4275: Cross-site scripting in the Carbon Black Response add-on for IBM QRadar SIEM. Affects Carbon Black Response versions 1.0.1–1.3.0. The vulnerability allows injecting arbitrary JavaScript into the Web UI, potentially leaking credentials within a trusted session. Root cause: improper ...

CVE-2019-4599

IBM Sterling Connect:Express for UNIX FTP Server is affected by a heap-based buffer overflow in the FTP service (CVE-2019-4599). The issue arises from improper bounds checking in the ALLO handling of the FTP server, where the static buffer in BSS (rem_file) can overflow when processing input with...

CVE-2019-14661

Summary : IBM Operations Analytics Predictive Insights is affected by CVE-2019-14661 (and related Jackson-databind CVEs). The IBM security bulletins state that Jackson-databind is used (limited to the REST Mediation utility) and that the product has been addressed for these CVEs. Affected product...

CVE-2020-4637

IBM Resilient App Host (Beta) in Resilient OnPrem IBM Security SOAR was found to use weaker-than-expected cryptographic algorithms, which could allow decryption of highly sensitive information. This is documented under CVE-2020-4637 in IBM’s security bulletin, which identifies the affected produc...

CVE-2020-4443

IBM OpenPages with Watson is affected by CVE-2020-4443 (XSS). The vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Affected product/version: IBM OpenPages with Watson v8.1. Remediation: apply 8.1 Interim Fix...

CVE-2020-4440

IBM OpenPages with Watson has addressed CVE-2020-4440, a reverse tabnabbing vulnerability. An authenticated user could replace a page with a phishing site to harvest sensitive information. Affected product: IBM OpenPages with Watson v8.1. CVSS Base score 6.5. Remediation: apply IBM OpenPages with...

CVE-2012-5035

Technical details for CVE-2012-5035 are not publicly available in the provided documents. No affected products, impact, or fixes are stated here. Monitor for updates.

CVE-2018-10247

The connected IBM bulletins describe multiple Jetty/Jasper vulnerabilities that affect IBM Rational Synergy (7.2.1.x) and Rational Change (5.3.x) deployments using Jetty 8.1.3. Vulnerabilities include session hijacking and HTTP request smuggling, plus information disclosure and DoS across several...

CVE-2020-5028

This CVE (CVE-2020-5028) is documented in IBM’s Security Bulletin for IBM Tivoli/Workload Scheduler. The vulnerability is an XSS issue in the Web UI of IBM Tivoli Workload Scheduler (IBM Workload Scheduler) affecting version 9.3.x and 9.4.x. The root cause is cross-site scripting that could allow...

CVE-2020-4745

IBM FileNet Content Manager is vulnerable to cross-site request forgery via its GraphQL endpoint (CVE-2020-4745). Affected: FileNet Content Manager 5.5.4 and 5.5.5. Root cause: CSRF in GraphQL handling could allow malicious actions from an authenticated user. CVSS Baseline 4.3. Remediation: upgra...

CVE-2016-6063

Summary: CVE-2016-6063 affects IBM Resilient prior to version 28 due to the use of outdated SSH ciphers. Affected versions: IBM Resilient 26.0, 26.1, 26.2, 26.3, 26.4, 27.0, 27.1. Impact: potential vulnerability in SSH communication when outdated ciphers are used. Root cause: default sshd_config ...

CVE-2017-1657

The connected IBM Security Bulletin confirms CVE-2017-1657 affects IBM Resilient, where weaker than expected cryptographic algorithms could allow decrypting highly sensitive information. Affected versions are IBM Resilient 27.0–27.2 and 28.0–28.3. IBM has addressed the issue by updating to versio...

CVE-2016-6064

IBM Resilient stores passwords in clear text, affecting IBM Resilient versions 27.0–28.1. The issue can enable local users with filesystem access to read credentials and potentially escalate privileges or access integrated systems. CVSS Base Score is 6.2 with vector CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S...