Security Bulletin: A security vulnerability was identified in IBM Jazz Reporting Service (CVE-2024-25051)

Summary A security vulnerability was identified in IBM Jazz Reporting Service, where user sessions are not properly invalidated after logout. Vulnerability Details CVEID:CVE-2024-25051 DESCRIPTION: IBM Jazz Reporting Service does not invalidate session after logout which could allow an...

The vulnerability of the web interface of the IBM Jazz for Service Management platform’s process automation and management system lies in the lack of protective measures for the website structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the web interface of the IBM Jazz for Service Management platform management and automation processes is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remote...

Malicious code in jazz_services-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a10ab75b61db729e2ded7abcf4d5af6329e91554ab796f26e081becc4cfa851 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Apache Derby vulnerability addressed in IBM JRS (Jazz Reporting Service) [CVE-2022-46337]

Summary Apache Derby might allow a remote attacker to bypass security restrictions caused by an LDAP injection vulnerability in the authenticator. This vulnerability affects IBM Jazz Reporting Service. This bulletin identifies the steps to take to mitigate the vulnerability. Vulnerability Details...

Security Bulletin: IBM JRS (Jazz Reporting Service) uses a web link with untrusted references to an external site.

Summary IBM JRS Jazz Reporting Service uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims' web browser. The web application produces links to untrusted...

CVE-2024-52892

IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2024-52892

IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2024-52892

IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2024-52892 IBM Jazz for Service Management Cross-Site Scripting

IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2024-52892 IBM Jazz for Service Management Cross-Site Scripting

IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2024-52892

IBM Jazz for Service Management versions 1.1.3–1.1.3.23 are affected by CVE-2024-52892 due to a cross-site scripting vulnerability in the Web UI (via the searchWord parameter on the static help page). The vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript, potentially ...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to an XML External Entity Injection (XXE) vulnerability (CVE-2024-45086)

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is vulnerable to an XML External Entity Injection XXE vulnerability in the administrative console. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Produc...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to stored cross-site scripting (CVE-2024-45071)

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is vulnerable to stored cross-site scripting in the administrative console. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affecte...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to stored cross-site scripting (CVE-2024-45073)

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is vulnerable to stored cross-site scripting in the administrative console. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affecte...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to a denial of service (CVE-2024-45085)

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is vulnerable to a denial of service when a JSF application configured with Sun Reference Implementation 1.2 is deployed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Security Bulletin: Improper Resource Allocation in IBM Jazz for Service Management due to Apache Commons IO XmlStreamReader Class (CVE-2024-47554)

Summary Improper Resource Allocation in IBM Jazz for Service Management due to Apache Commons IO XmlStreamReader Class CVE-2024-47554 Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Apache Commons IO is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw...

IBM Jazz Foundation Cross-Site Scripting Vulnerability (CNVD-2025-02830)

IBM Jazz Foundation is a next-generation collaboration platform for software delivery technology from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Jazz Foundation. An attacker could exploit the vulnerability to embed arbitrary JavaScript code in the Web ...

IBM Jazz for Service Management Access Control Error Vulnerability (CNVD-2025-02831)

IBM Jazz for Service Management is an integrated service management product from International Business Machines IBM that provides visibility into the service management environment. An Access Control Error vulnerability exists in IBM Jazz for Service Management that stems from improper access...

Malicious code in jazz_token-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3bd3fcfec7eb7354597369d7c1b2496841dbeabc3876ca1c150802f8bc3221f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-197 Malicious code in jazz_token-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3bd3fcfec7eb7354597369d7c1b2496841dbeabc3876ca1c150802f8bc3221f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...