CVE-2021-29766

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202680...

CVE-2021-29766

CVE-2021-29766 affects IBM i2 Analyze (Analyst’s Notebook Premium) versions 4.3.0, 4.3.1, and 4.3.2. The vulnerability is an information-disclosure flaw where detailed browser error messages may reveal sensitive data to remote attackers, potentially aiding further attacks. Documented CVSS: 3.x ve...

CVE-2021-20431

The CVE-2021-20431 vulnerability affects IBM i2 Analyst’s Notebook Premium 9.2.0, 9.2.1, and 9.2.2, where sessions are not invalidated after logout, potentially allowing an attacker to obtain sensitive information from the system. The issue is documented with a base CVSSv3.1 score of 6.5 (Network...

CVE-2021-20430

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196341...

CVE-2021-20430

CVE-2021-20430 affects IBM i2 Analyst’s Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, 4.3.2). A remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser, enabling information disclosure. Affected products and versions are IBM i2 Analyz...

CVE-2020-4623

IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a specially-crafted .DLL file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 184984...

CVE-2020-4623

IBM i2 iBase 8.9.13 is affected by CVE-2020-4623 due to a DLL search order hijacking flaw that could allow a local authenticated attacker to execute arbitrary code. The issue is described across multiple sources (NVD entry and IBM Security Bulletin), identifying the affected product as IBM i2 iBa...

Security Bulletin: IBM i2 Analyst's Notebook Premium has an information disclosure vulnerability (CVE-2021-29767)

Summary Excess information was disclosed in http requests from i2 Analist's Notebook Premium to the i2 Analyze server. Vulnerability Details CVEID: CVE-2021-29767 DESCRIPTION: IBM i2 Analyst's Notebook Premium could allow a remote attacker to obtain sensitive information when a detailed technical...

Security Bulletin: IBM i2 Analyze missing security header (CVE-2021-29769)

Summary Some secure header options were missing in communication with the i2 Analyze server. Vulnerability Details CVEID: CVE-2021-29769 DESCRIPTION: IBM i2 Analyst's Notebook Premium does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the...

Security Bulletin: Information disclosure vulnerability in IBM i2 Analyze (CVE-2021-29766)

Summary In certain situations more information than is necessary is communicated via error messages or requests Vulnerability Details CVEID: CVE-2021-29766 DESCRIPTION: IBM i2 Analyst's Notebook Premium could allow a remote attacker to obtain sensitive information when a detailed technical error...

Security Bulletin: IBM i2 Analyst's Notebook Premium has an information disclosure vulnerability (CVE-2021-29784)

Summary More information than is necessary is sometimes displayed in i2 Analyst's Notebook Premium error dialogs. Vulnerability Details CVEID: CVE-2021-29784 DESCRIPTION: IBM i2 Analyze could allow a remote attacker to obtain sensitive information when a detailed technical error message is return...

Security Bulletin: IBM i2 Analyze and i2 Analyst's Notebook Premium has session handling vulnerability (CVE-2021-20431)

Summary i2 Analyze is subject to an auth token expiration vulnerability. Vulnerability Details CVEID: CVE-2021-20431 DESCRIPTION: IBM i2 Analyst's Notebook Premium does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. CVSS Base...

Security Bulletin: IBM i2 Analyze has an information disclosure vulnerability (CVE-2021-20430)

Summary i2 Analyze communcated unnecessary information Liberty default landnig page with an unmodified deployment. Vulnerability Details CVEID: CVE-2021-20430 DESCRIPTION: IBM i2 Analyst's Notebook Premium could allow a remote attacker to obtain sensitive information when a detailed technical err...

Security Bulletin: IBM i2 iBase vulnerable to DLL highjacking (CVE-2020-4623)

Summary i2 iBase is vulnerable to DLL highjacking attacks. Vulnerability Details CVEID: CVE-2020-4623 DESCRIPTION: IBM i2 iBase could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a specially-crafted .DLL file, ...

IBM i2 Analysts Notebook Premium 安全漏洞

IBM i2 Analyst's Notebook Premium is a premium version of IBM i2 Analyst's Notebook from IBM of America. IBM i2 Analyst's Notebook Premium is vulnerable to an information disclosure vulnerability that could be exploited by an attacker to obtain cookie values by listening to traffic...

Security Bulletin: IBM i2 Analyze is affected by multiple vulnerabilities in IBM DB2

Summary Deployments of i2 Analyze using DB2 will need to refer to the DB2 Security Bulletins linked below to determine if they are vulnerable and apply fixes as detailed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM i2 Analyst's Notebook Vulnerable to Memory Corruption Vulnerabilities

Summary IBM i2 Analyst's Notebook and Analyst's Notebook Premium addressed several memory corruption vulnerabilities. Vulnerability Details CVEID: CVE-2020-4724 DESCRIPTION: IBM i2 Analyst's Notebook could allow a local attacker to execute arbitrary code on the system, caused by a memory...

Security Bulletin: IBM I2 iBase is vulnerable to unrestricted file upload (CVE-2020-4588)

Summary iBase file uploads does not restrict the file type to be uploaded. This issue has been addressed. Vulnerability Details CVEID: CVE-2020-4588 DESCRIPTION: IBM i2 iBase could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result i...

i2-stores.com Cross Site Scripting vulnerability OBB-1470259

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Security Bulletin: Sensitive information vulnerability affects IBM i2 iBase (CVE-2020-4584)

Summary The sensitive information vulnerability was addressed in IBM i2 iBase. Vulnerability Details CVEID: CVE-2020-4584 DESCRIPTION: IBM i2 iBase could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information...