CVE-2022-33164

CVE-2022-33164 affects IBM Security Directory Server (7.2.0). A remote attacker could exploit a path traversal via /.. to view or write arbitrary files. IBM bulletin cites CVSS base 8.7 (CVE-2022-33164) and provides remediation: IBM Security Directory Server 6.4.0 interim fix 28, IBM Security Dir...

CVE-2023-32332

CVE-2023-32332 affects IBM Maximo Application Suite (MAS) versions 8.9–8.10 and IBM Maximo Asset Management (MAM) 7.6.1.2–7.6.1.3, vulnerable to HTML injection that could allow a remote attacker to cause HTML/JS execution in the browser under the hosting site’s security context. The Red Hat/IBM a...

CVE-2023-32332 IBM Maximo Application Suite and IBM Maximo Asset Management HTML injection

IBM Maximo Application Suite 8.9, 8.10 and IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-For...

CVE-2023-38736

IBM QRadar WinCollect Agent 10.0 through 10.1.6, when installed to run as ADMIN or SYSTEM, is vulnerable to a local escalation of privilege attack that a normal user could utilize to gain SYSTEM permissions. IBM X-Force ID: 262542...

CVE-2023-38736 IBM QRadar WinCollect Agent privilege escalation

IBM QRadar WinCollect Agent 10.0 through 10.1.6, when installed to run as ADMIN or SYSTEM, is vulnerable to a local escalation of privilege attack that a normal user could utilize to gain SYSTEM permissions. IBM X-Force ID: 262542...

CVE-2023-38736 IBM QRadar WinCollect Agent privilege escalation

IBM QRadar WinCollect Agent 10.0 through 10.1.6, when installed to run as ADMIN or SYSTEM, is vulnerable to a local escalation of privilege attack that a normal user could utilize to gain SYSTEM permissions. IBM X-Force ID: 262542...

CVE-2023-32332: Improper Neutralization of Input During Web Page Generation

IBM Maximo Application Suite 8.9, 8.10 and IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-For...

Security Bulletin: Vulnerabilities found in poi-3.9.jar which is shipped with IBM® Intelligent Operations Center [CVE-2017-12626 and X-Force ID: 220800]

Summary Multiple vulnerabilities have been identified in poi-3.9.jar which is shipped with IBM® Intelligent Operations Center. Information about these vulnerabilities affecting IBM® Intelligent Operations Center have been published which addressed the applicable CVE 2017-1262 and X-Force ID: 2208...

Security Bulletin: IBM Storage Protect Snapshot for UNIX and Linux is vulnerable to sensitive information disclosure due to IBM GSKit ( CVE-2023-32342 )

Summary IBM GSKit is used by IBM Storage Protect Snapshot for UNIX and Linux and may be affected by vulnerability CVE-2023-32342. Vulnerability Details CVEID:CVE-2023-32342 DESCRIPTION: IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel ...

Security Bulletin: Vulnerability found in pdfbox-1.8.1.jar which is shipped with IBM® Intelligent Operations Center(220742, CVE-2018-11797, CVE-2016-2175)

Summary Vulnerability have been identified in pdfbox-1.8.1.jar which is shipped with IBM® Intelligent Operations Center. Information about this vulnerability affecting IBM® Intelligent Operations Center have been published and addressed the applicable CVEs. Vulnerability Details...

CVE-2023-35906

IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649...

CVE-2023-22870

IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 244121...

Information disclosure

IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow a local user with specific information about the system to obtain privileged information due to inadequate memory clearing during operations. IBM X-Force ID: 252139...

Improper access control

IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649...

Information disclosure

IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 244121...

CVE-2023-35906

IBM Aspera Faspex 5.0.5 and earlier versions are affected by CVE-2023-35906, where improper access controls allow a remote attacker to bypass IP restrictions. The issue is an unauthorized access control flaw in Faspex’s handling of IP-based access, enabling bypass of IP whitelisting. Remediation ...

CVE-2023-35906 IBM Aspera Faspex security bypass

IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649...

CVE-2023-35906 IBM Aspera Faspex security bypass

IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649...

CVE-2023-22870 IBM Aspera Faspex information disclosure

IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 244121...

CVE-2023-32338

IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a local user with container access. IBM X-Force ID: 255585...