CVE-2020-4892

CVE-2020-4892 affects IBM Emptoris Contract Management 10.1.3.x, with a reflected cross-site scripting vulnerability in the Web UI that could allow an attacker to inject arbitrary JavaScript and potentially disclose credentials in a trusted session. The issue is documented in the IBM Security Bul...

CVE-2020-4892

IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190979...

PT-2021-12216

Name of the Vulnerable Software and Affected Versions IBM Emptoris Contract Management version 10.1.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2021-12220

Name of the Vulnerable Software and Affected Versions IBM Emptoris Contract Management and IBM Emptoris Spend Analysis versions 10.1.0 through 10.1.3 Description A remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser, which could be...

CVE-2020-4897: Generation of Error Message Containing Sensitive Information

IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM...

CVE-2020-4892: Improper Neutralization of Input During Web Page Generation

IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190979...

IBM Emptoris Contract Management and IBM Emptoris Spend Analysis security vulnerabilities

IBM Emptoris Contract Management is a web-based contract management software for managing and maintaining legal contracts between parties.IBM Emptoris Spend Analysis is a web-based information and management tool that supports organizations in consolidating spend data from dispersed and disparate...

IBM Emptoris Contract Management Cross-site Scripting Vulnerability

IBM Emptoris Contract Management is a web-based contract management software for managing and maintaining legal contracts between parties. A cross-site scripting vulnerability exists in IBM Emptoris Contract Management 10.1.3. An attacker can exploit this vulnerability to embed arbitrary JavaScri...

Security Bulletin: Information Disclosure Vulnerability Affects IBM Emptoris Contract Management (CVE-2020-4897)

Summary Information disclosure vulnerability verbose application errors affects IBM Emptoris Contract Management. Vulnerability Details CVEID: CVE-2020-4897 DESCRIPTION: IBM Emptoris could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned ...

CVE-2020-4892

IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190979...

Code injection

The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring LRC, an Ethereum token, lacks access control for fee swapping and thus allows price manipulation...

CVE-2020-35962

The CVE-2020-35962 issue affects Loopring (LRC) by the vault protocol’s sellTokenForLRC function in its smart contract, which lacks access control for fee swapping. This vulnerability enables price manipulation within the on-chain logic. The documented impact is a HIGH severity in CVSS 3.1 (I:H) ...

CVE-2020-35962

The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring LRC, an Ethereum token, lacks access control for fee swapping and thus allows price manipulation...

CVE-2021-3006

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

CVE-2021-3006

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

Design/Logic Flaw

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

CVE-2021-3006

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

CVE-2021-3006

The CVE-2021-3006 entry concerns the Seal Finance (Seal) Ethereum token. The breed function in its smart contract lacks access control, enabling price manipulation. Exploitation occurred in the wild during December 2020 and January 2021. The available documents confirm the root cause (unauthorize...

CVE-2021-3004

The deposit function in the smart contract implementation for Stable Yield Credit yCREDIT, an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should...

CVE-2021-3004

Technical details about CVE-2021-3004 are not present in the connected documents. The description notes incorrect calculations in the yCREDIT deposit function, but no vendor/version/exploit specifics are supplied here; monitor for updates.