CVE-2022-22416

IBM Sterling Partner Engagement Manager is affected by CVE-2022-22416 (SSRF) in versions 6.1.2, 6.2, and Cloud/SaaS 22.2. The root cause is input validation failure that allows an authenticated attacker to cause the system to issue unauthorized requests, potentially enabling network enumeration a...

CVE-2022-22360

IBM Sterling Partner Engagement Manager is affected by an LDAP injection vulnerability (CVE-2022-22360) in versions 6.1.2, 6.2 and Cloud/SaaS 22.2. The flaw enables a remote authenticated attacker to manipulate LDAP queries, potentially granting permissions to unauthorized resources. Affected edi...

CVE-2022-22360

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources...

CVE-2022-22359

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652...

CVE-2022-22359

CVE-2022-22359 affects IBM Sterling Partner Engagement Manager (Essentials/Standard editions 6.1.2, 6.2; Cloud/SaaS 22.2). Root cause: a cross-site request forgery (CSRF) flaw stemming from insufficient validation of a user request parameter, enabling an attacker to perform malicious actions on b...

CVE-2022-22358

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651...

CVE-2022-22358

The CVE-2022-22358 issue affects IBM Sterling Partner Engagement Manager: XXE in XML processing impacts the following products/versions—Essentials Edition 6.1.2, Standard Edition 6.1.2, Essentials Edition 6.2, Standard Edition 6.2, and Cloud/SaaS 22.2. The root cause is an XML External Entity vul...

IBM Sterling Partner Engagement Manager 注入漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. An LDAP injection vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from the fact that some parameters in the code are not properly filtered and can be exploited by an authenticated...

IBM Sterling Partner Engagement Manager 代码问题漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM, Inc. An XML external entity injection vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from a network system or product that does not set the correct filtering to allow references to...

IBM Sterling Partner Engagement Manager 代码问题漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. A server-side request forgery vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from the product's failure to properly validate user input and could be exploited by an authenticated...

IBM Sterling Partner Engagement Manager 跨站请求伪造漏洞

IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. A cross-site request forgery vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from a WEB application that does not adequately validate that the request is from a trusted user. An...

IBM Sterling Partner Engagement Manager 跨站脚本漏洞

A cross-site scripting vulnerability exists in IBM Sterling Partner Engagement Manager, an automation management tool from IBM. IBM Sterling Partner Engagement Manager stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit the vulnerability to...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to unspecified vulnerability due to Java (CVE-2021-35603)

Summary IBM Sterling Partner Engagement Manager bundled with Java version 8.0.7.0 where number of operations in the JSSE component are implemented in a way that means they could be exploited by an attacker in a side-channel attack due to timing differences. Issue has been addressed. Vulnerability...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to LDAP injection (CVE-2022-22360)

Summary IBM Sterling Partner Engagement Manager is vulnerable to LDAP injection. The issue has been addressed. Vulnerability Details CVEID:CVE-2022-22360 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow a remote authenticated attacker to conduct an LDAP injection. By using a...

Security Bulletin: IBM Partner Engagement Manager is vulnerable to improper restriction of XXE (CVE-2022-22358)

Summary IBM Sterling Partner Engagement Manager has addressed an XXE vulnerability. Vulnerability Details CVEID:CVE-2022-22358 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploi...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to reflected cross-site scripting (CVE-2022-22417)

Summary IBM Sterling Partner Engagement Manager has addressed a cross-site scripting XSS vulnerability. Vulnerability Details CVEID:CVE-2022-22417 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to server-side request forgery (CVE-2022-22416)

Summary IBM Sterling Partner Engagement Manager has addressed a server-side request forgery. Vulnerability Details CVEID:CVE-2022-22416 DESCRIPTION: IBM Sterling Partner Engagement Manager is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to cross-site request forgery (CVE-2022-22359)

Summary IBM Sterling Partner Engagement Manager could allow a remote attacker to enable Cross-Site Request Forgery CSRF on the system, caused by a parameter from a user request. The issue has been addressed. Vulnerability Details CVEID:CVE-2022-22359 DESCRIPTION: IBM Sterling Partner Engagement...

CVE-2022-22416

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...

CVE-2022-22360

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources...