CVE-2022-2539

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization...

PT-2022-17255 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.6 through 15.0.4 GitLab CE/EE versions 15.1 through 15.1.3 GitLab CE/EE versions 15.2 through 15.2.0 Description: An issue in GitLab CE/EE allowed a project member to filter issues by contact and organization...

CVE-2019-4519

CVE-2019-4519 is addressed in multiple IBM Financial Transaction Manager products. The connected IBM security bulletins indicate a validation vulnerability where input is not properly validated, potentially allowing an authenticated user to prevent audit log entries. Affected products and version...

CVE-2019-4517

IBM has published multiple advisories for CVE-2019-4517 across its Financial Transaction Manager (FTM) family. The vulnerability is described as a remote open-redirect/phishing vector that can spoof URLs to redirect users to malicious sites. Affected products/versions include: FTM ACH v3.0.6.0–3....

CVE-2019-4529

IBM Sterling Connect:Direct for UNIX is vulnerable to privilege escalation via a malicious getuid() replacement in the C/C++ API. Affected: UNIX versions 6.0.0, 4.3.0, and 4.2.0. An authenticated user with limited Connect:Direct privileges can exploit a custom application to gain unauthorized acc...

CVE-2020-4637

IBM Resilient App Host (Beta) in Resilient OnPrem IBM Security SOAR was found to use weaker-than-expected cryptographic algorithms, which could allow decryption of highly sensitive information. This is documented under CVE-2020-4637 in IBM’s security bulletin, which identifies the affected produc...

CVE-2020-4443

IBM OpenPages with Watson is affected by CVE-2020-4443 (XSS). The vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Affected product/version: IBM OpenPages with Watson v8.1. Remediation: apply 8.1 Interim Fix...

CVE-2017-1796

CVE-2017-1796 affects IBM Rational Developer for System z and IBM Developer for z Systems where weaker cryptographic algorithms could allow decrypting sensitive information (CVSS 5.9, vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Affected products/versions include Rational Developer for S...

CVE-2020-4423

CVE-2020-4423 concerns IBM Predictive Maintenance and Quality (PMQ) UI where the SSL session cookie (JSESSIONID) is missing the secure attribute, allowing potential exposure of cookies over HTTPS. Affected PMQ versions: 1.0.x, 2.5.x, 2.0.x. Impact: session/cookie theft risk; remediation is to ena...

CVE-2020-4847

IBM Verify Gateway (IVG) contains CVE-2020-4847: when IVG components make API calls, tenant secrets can be exposed (client API secrets, access tokens, cookies) and used to impersonate a tenant. Base score 7.1. Affected IVG versions: RADIUS 1.0.0; PAM 1.0.0, 1.0.1; WinLogin 1.0.0, 1.0.1. Remediati...

CVE-2019-4534

CVE-2019-4534 is addressed in IBM Resilient OnPrem security bulletin. The issue involves hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. Affected products are IBM Resilient OnPrem v32.x and v33.x. Mitigation is to upgrade to 34.0 or hig...

CVE-2017-1658

IBM Resilient (27.0–27.2 and 28.0–28.3) is affected by CVE-2017-1658, where permissions on a security-critical resource allowed read/modify by unintended actors, potentially leaking internal information via generated source files. The bulletin states the fix is to upgrade to 29.0 or later; there ...

CVE-2016-6067

IBM Resilient is vulnerable to Stored XSS (CVE-2016-6067). All versions prior to 26.3 are affected. The vulnerability allows authenticated users to inject arbitrary JavaScript into the Web UI, potentially exposing credentials within a trusted session. CVSSv3 base score 5.4. Remediation: upgrade o...

CVE-2016-6064

IBM Resilient stores passwords in clear text, affecting IBM Resilient versions 27.0–28.1. The issue can enable local users with filesystem access to read credentials and potentially escalate privileges or access integrated systems. CVSS Base Score is 6.2 with vector CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S...

CVE-2017-1529

CVE-2017-1529 is publicly documented via IBM for Rational DOORS Next Generation with potential for a cross-site scripting (XSS) attack in the Web UI. The IBM bulletin actually references CVE-2018-1529 and affects Rational Requirements Composer 5.0.x (5.0.0–5.0.2) and Rational DOORS Next Generatio...

CVE-2019-4449

IBM Maximo Asset Management is affected by CVE-2019-4449, a privilege-escalation vulnerability exploitable by an authenticated user. The core Maximo Asset Management 7.6 product is affected, with multiple IBM Industry Solutions and IBM Control Desk products also impacted when installed atop an af...

CVE-2021-29876

Summary : CVE-2021-29876 is implicated in IBM Robotic Process Automation with Automation Anywhere 11.0 via a Lucky Thirteen timing attack on CBC-mode TLS, enabling a MITM to potentially obtain plaintext. Affected version : 11.0. Impact : confidentiality risk (C:H) with no server-side integrity im...

CVE-2021-35737

Technical details for CVE-2021-35737 are not provided in the supplied documents. Monitor for updates from official sources.

CVE-2021-44288

Technical details are not publicly available in the provided documents. This CVE entry is reserved; monitor for updates as new information is released.

CVE-2020-26691

IBM’s bulletin for IBM Rational Build Forge 8.0.x lists CVE-2020-26691 as one of several vulnerabilities affecting Build Forge 8.0–8.0.0.20. The connected document provides remediation: upgrade to IBM Rational Build Forge 8.0.0.21, which includes Apache HTTP Server 2.4.52. The description for CVE...