IBM Sterling Partner Engagement Manager 跨站脚本漏洞

A cross-site scripting vulnerability exists in IBM Sterling Partner Engagement Manager, an automation management tool from IBM. IBM Sterling Partner Engagement Manager stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit the vulnerability to...

CVE-2022-22416: Server-Side Request Forgery (SSRF)

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...

PT-2022-15388

Name of the Vulnerable Software and Affected Versions IBM Sterling Partner Engagement Manager versions 6.1.2 through 6.2 IBM Sterling Partner Engagement Manager Cloud/SasS version 22.2 Description The issue allows a remote attacker to exploit an XML External Entity Injection XXE attack when...

PT-2022-15389

Name of the Vulnerable Software and Affected Versions IBM Sterling Partner Engagement Manager versions 6.1.2, 6.2, and Cloud/SasS 22.2 Description The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to cross-site request...

PT-2022-15420

Name of the Vulnerable Software and Affected Versions IBM Sterling Partner Engagement Manager versions 6.1.2 through 6.2 IBM Sterling Partner Engagement Manager Cloud/SasS version 22.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended...

PT-2022-15419

Name of the Vulnerable Software and Affected Versions IBM Sterling Partner Engagement Manager versions 6.1.2 through 6.2 IBM Sterling Partner Engagement Manager Cloud/SasS version 22.2 Description The issue allows an authenticated attacker to send unauthorized requests from the system, potentiall...

IBM Sterling Partner Engagement Manager 代码问题漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. A server-side request forgery vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from the product's failure to properly validate user input and could be exploited by an authenticated...

IBM Sterling Partner Engagement Manager 注入漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. An LDAP injection vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from the fact that some parameters in the code are not properly filtered and can be exploited by an authenticated...

IBM Sterling Partner Engagement Manager 代码问题漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM, Inc. An XML external entity injection vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from a network system or product that does not set the correct filtering to allow references to...

CVE-2022-22417: Improper Neutralization of Input During Web Page Generation

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2022-22359: Cross-Site Request Forgery (CSRF)

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652...

CVE-2022-22358: Improper Restriction of XML External Entity Reference

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651...

CVE-2022-22360: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources...

IBM Sterling Partner Engagement Manager 跨站请求伪造漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. A cross-site request forgery vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from a WEB application that does not adequately validate that the request is from a trusted user. An...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to unspecified vulnerability due to Java (CVE-2021-35603)

Summary IBM Sterling Partner Engagement Manager bundled with Java version 8.0.7.0 where number of operations in the JSSE component are implemented in a way that means they could be exploited by an attacker in a side-channel attack due to timing differences. Issue has been addressed. Vulnerability...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to LDAP injection (CVE-2022-22360)

Summary IBM Sterling Partner Engagement Manager is vulnerable to LDAP injection. The issue has been addressed. Vulnerability Details CVEID:CVE-2022-22360 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow a remote authenticated attacker to conduct an LDAP injection. By using a...

Security Bulletin: IBM Partner Engagement Manager is vulnerable to improper restriction of XXE (CVE-2022-22358)

Summary IBM Sterling Partner Engagement Manager has addressed an XXE vulnerability. Vulnerability Details CVEID:CVE-2022-22358 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploi...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to reflected cross-site scripting (CVE-2022-22417)

Summary IBM Sterling Partner Engagement Manager has addressed a cross-site scripting XSS vulnerability. Vulnerability Details CVEID:CVE-2022-22417 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to server-side request forgery (CVE-2022-22416)

Summary IBM Sterling Partner Engagement Manager has addressed a server-side request forgery. Vulnerability Details CVEID:CVE-2022-22416 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to cross-site request forgery (CVE-2022-22359)

Summary IBM Sterling Partner Engagement Manager could allow a remote attacker to enable Cross-Site Request Forgery CSRF on the system, caused by a parameter from a user request. The issue has been addressed. Vulnerability Details CVEID:CVE-2022-22359 DESCRIPTION: IBM Sterling Partner Engagement...