CVE-2021-20430

CVE-2021-20430 affects IBM i2 Analyst’s Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, 4.3.2). A remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser, enabling information disclosure. Affected products and versions are IBM i2 Analyz...

CVE-2021-20430: Generation of Error Message Containing Sensitive Information

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196341...

CVE-2021-29766: Generation of Error Message Containing Sensitive Information

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202680...

PT-2021-18464

Name of the Vulnerable Software and Affected Versions IBM i2 Analyst's Notebook Premium versions 4.3.0 through 4.3.2 Description The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in...

PT-2021-13960

Name of the Vulnerable Software and Affected Versions: IBM i2 Analyst's Notebook Premium versions 4.3.0 through 4.3.2 Description: The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used ...

PT-2021-18467

Name of the Vulnerable Software and Affected Versions IBM i2 Analyst's Notebook Premium versions 4.3.0 through 4.3.2 Description The issue allows an authenticated user to perform unauthorized actions due to hazardous input validation. Recommendations For versions 4.3.0 through 4.3.2, at the momen...

PT-2021-18465

Name of the Vulnerable Software and Affected Versions IBM i2 Analyst's Notebook Premium versions 9.2.0 through 9.2.2 Description The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in...

CVE-2021-29770: Improper Input Validation

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 202771...

CVE-2021-29767: Generation of Error Message Containing Sensitive Information

IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202681...

CVE-2021-20431: Insufficient Session Expiration

IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196342...

IBM i2 Analyze安全漏洞

IBM i2 Analyst's Notebook Premium is an intuitive analysis environment that combines data storage, analysis tools, visualization and dissemination capabilities. i2 Analyst's Notebook Premium contains a security vulnerability that could be exploited by remote attackers to obtain sensitive...

PT-2021-18466

Name of the Vulnerable Software and Affected Versions IBM i2 Analyst's Notebook Premium versions 4.3.0 through 4.3.2 Description The issue concerns the failure to set the secure attribute on authorization tokens or session cookies. Attackers can exploit this by sending a http:// link to a user or...

CVE-2021-29769: Cleartext Transmission of Sensitive Information

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie...

PT-2021-13961

Name of the Vulnerable Software and Affected Versions: IBM i2 Analyst's Notebook Premium versions 9.2.0 through 9.2.2 Description: The issue allows an attacker to obtain sensitive information from the system because the session is not invalidated after logout. Recommendations: For versions 9.2.0...

Vulnerabilities fixed in IBM i2 Analyst's Notebook

Vulnerabilities have been fixed in the IBM i2 Analyst's Notebook. A malicious party could exploit the vulnerabilities to obtain system data and sensitive information. IBM has released updates to fix the vulnerabilities. For more information, see: https://www.ibm.com/support/pages/node/6474861...

Security Bulletin: IBM i2 Analyst's Notebook Premium has an information disclosure vulnerability (CVE-2021-29767)

Summary Excess information was disclosed in http requests from i2 Analist's Notebook Premium to the i2 Analyze server. Vulnerability Details CVEID: CVE-2021-29767 DESCRIPTION: IBM i2 Analyst's Notebook Premium could allow a remote attacker to obtain sensitive information when a detailed technical...

Security Bulletin: i2 Analyse and Analyst's Notebook Premium have hyperlink clicking vulnerability (CVE-2021-29770)

Summary IBM i2 Analyse and Analyst's Notebook Premium are vulnerable to malicious hyperlinks in certain data fields Vulnerability Details CVEID: CVE-2021-29770 DESCRIPTION: IBM i2 Analyst's Notebook Premium could allow an authenticated user to perform unauthorized actions due to hazardous input...

Security Bulletin: IBM Analyst's Notebook Premium uses a component with known vulnerabilities (CVE-2020-16013, CVE-2020-16009, CVE-2020-15999)

Summary IBM i2 Analyst's Notebook Premium uses a browser component version with known vulnerabilities. Vulnerability Details CVEID: CVE-2020-16013 DESCRIPTION: Google Chrome could allow a remote attacker to bypass security restrictions, caused by inappropriate implementation in V8. By persuading ...

Security Bulletin: IBM i2 Analyze and i2 Analyst's Notebook Premium has session handling vulnerability (CVE-2021-20431)

Summary i2 Analyze is subject to an auth token expiration vulnerability. Vulnerability Details CVEID: CVE-2021-20431 DESCRIPTION: IBM i2 Analyst's Notebook Premium does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. CVSS Base...

CVE-2021-29769

IBM i2 Analyst's Notebook Premium IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie...