CVE-2021-33517

CVE-2021-33517 and CVE-2021-36090 are vulnerabilities in Apache Commons Compress that affect IBM WebSphere Liberty (and WebSphere Liberty-based bundles) used in IBM Cloud Pak for Applications and IBM WebSphere Application Server families. The issues cause denial of service through memory-related ...

CVE-2018-1687

IBM API Connect is vulnerable to a denial-of-service (CVE-2018-1687) due to a lack of rate limiting in the TCP listener. A remote attacker could launch a TCP SYN flood to exhaust CPU and memory. Affected: IBM API Connect versions 5.0.0.0–5.0.8.3. Remediation: upgrade to IBM API Connect Developer ...

CVE-2019-4223

IBM OpenPages GRC Platform is affected by an information-disclosure vulnerability tracked as CVE-2019-4223. The issue affects IBM OpenPages GRC Platform version 8.0 and allows disclosure of detailed error messages in WebApplication and API responses. Remediation provided by IBM fixes are availabl...

CVE-2019-4438

IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) is affected by CVE-2019-4438. The issue arises because Db2 does not enforce required authorization for certain commands when AUTO_REVAL is set to DEFERRED_FORCE, potentially exposing information to connected users. Affected: all f...

CVE-2017-1213

CVE-2017-1213 is cited in IBM BigInsights security bulletin as a Denial-of-Service flaw in Open Source Zookeeper affecting IBM BigInsights (IBM Open Platform with Apache Hadoop). The vulnerability could be exploited by an authenticated user when Jetty AdminServer is not available, and access is b...

CVE-2017-1123

CVE-2017-1123 is an escal ation of privilege in the IBM DS8000 Hardware Management Console (HMC) service interface. The IBM bulletin lists affected models (DS8880/DS8870/DS8800) and indicates affected code levels where exposure exists; a patch set CVE_1Q2018_v1.0 is available to remediate all lis...

CVE-2012-3339

CVE-2012-3339 is an XML External Entity (XXE) vulnerability in IBM InfoSphere Guardium. The issue allows remote authenticated users to obtain sensitive information, specifically via an error report that can reveal server file contents (including a database password). Affected platforms include IB...

CVE-2019-4042

IBM Sterling B2B Integrator is affected by CVE-2019-4042 through a permission-control vulnerability that could allow a user without proper permissions to access EBICS configuration using their own secure token. Affected versions are IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0. Remediation...

CVE-2020-4333

CVE-2020-4333 affects IBM WebSphere eXtreme Scale Liberty Deployment. The vulnerability is cross-site scripting caused by insufficient validation of client data in the Web UI, allowing an attacker to inject JavaScript to steal credentials within a trusted session. Affected product/version: WebSph...

CVE-2020-4332

CVE-2020-4332 affects IBM WebSphere eXtreme Scale Liberty Deployment (XSLD). The connected IBM bulletin confirms a remote information disclosure vulnerability in WebSphere eXtreme Scale Liberty Deployment, where a specially crafted HTTP request can let an attacker access highly sensitive data. Af...

CVE-2020-4331

IBM WebSphere eXtreme Scale Liberty Deployment is affected by a cross-site scripting vulnerability (CVE-2020-4331) in the Web UI, allowing arbitrary JavaScript to be embedded and potentially exposing credentials in a trusted session. Affected versions include WebSphere eXtreme Scale Liberty 8.6.1...

CVE-2019-4714

IBM InfoSphere Information Server family is affected by CVE-2019-4714, a cross-site scripting vulnerability that allows embedding arbitrary JavaScript in the Web UI and could lead to credentials disclosure within a trusted session. Affected products/versions include InfoSphere Information Server ...

CVE-2021-29789

CVE-2021-29789 affects IBM BMCs shipped with 8335-GTC/GTG/GTW OP910 and 8335-GTH/GTX OP920/OP930/OP940. The issue involves an incorrect configuration setting that could lead to denial of service or unintended firmware on the device. IBM’s bulletin highlights remediation via Workarounds and Mitiga...

CVE-2018-1400

CVE-2018-1400 is an IBM vulnerability: cross-site scripting in IBM Rational Software Architect Design Manager (RSA DM) / Rational Rhapsody Design Manager (RDM) Web UI. The issue allows embedding arbitrary JavaScript in configuration names, potentially leading to credential disclosure within a tru...

CVE-2019-4501

CVE-2019-4501 affects the MaaS360 Android App (versions 6.60 and earlier) in Android Enterprise Managed Work Profile Mode with WebView-based SSO login flows. The issue is an anomaly in Native Application SSO for SaaS apps using WebView that can subvert Android Enterprise security controls. It doe...

CVE-2018-1960

The MaaS360 iOS Application (versions

CVE-2017-1259

CVE-2017-1259 affects IBM Security Guardium. The IBM bulletin confirms that Guardium transmits user credentials in clear text, enabling potential reading via man-in-the-middle. Affected products/versions include Guardium 10.0, 10.0.1, 10.1, 10.1.2, and 10.1.3. Root cause is insecure credential tr...

CVE-2019-4629

IBM’s bulletin confirms CVE-2019-4629 as affecting IBM DOORS Next Generation (DNG/RRC) with a cross-site scripting vulnerability in the web UI. Affected products/versions include Rational CLM 6.0 through 6.0.6.1, Rational Quality Manager 6.0–6.0.6.1, Rational Team Concert 6.0–6.0.6.1, Rational DO...

CVE-2019-4604

IBM DOORS Next Generation (DNG/RRC) is affected by CVE-2019-4604, an XML External Entity (XXE) vulnerability in XML data processing. The issue could allow a remote attacker to expose sensitive information or cause memory resource consumption. Affected products/versions include Rational CLM 6.0 th...

CVE-2017-1472

The IBM Security Identity Governance Virtual Appliance is listed in the connected bulletin as vulnerable to CVE-2017-1472 (XML External Entity Injection when processing XML data). The vulnerability affects IBM IGI releases in the 5.2 family (5.2, 5.2.1, 5.2.2, 5.2.2.1, 5.2.3, 5.2.3.1, 5.2.3.2) an...