CVE-2022-35644

IBM’s advisory documents confirm CVE-2022-35644 is a persistent cross-site scripting vulnerability in IBM Business Process Manager and related IBM Business Automation products. The flaw allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a tru...

CVE-2019-4519

CVE-2019-4519 is addressed in multiple IBM Financial Transaction Manager products. The connected IBM security bulletins indicate a validation vulnerability where input is not properly validated, potentially allowing an authenticated user to prevent audit log entries. Affected products and version...

CVE-2019-4517

IBM has published multiple advisories for CVE-2019-4517 across its Financial Transaction Manager (FTM) family. The vulnerability is described as a remote open-redirect/phishing vector that can spoof URLs to redirect users to malicious sites. Affected products/versions include: FTM ACH v3.0.6.0–3....

CVE-2019-4529

IBM Sterling Connect:Direct for UNIX is vulnerable to privilege escalation via a malicious getuid() replacement in the C/C++ API. Affected: UNIX versions 6.0.0, 4.3.0, and 4.2.0. An authenticated user with limited Connect:Direct privileges can exploit a custom application to gain unauthorized acc...

CVE-2020-4443

IBM OpenPages with Watson is affected by CVE-2020-4443 (XSS). The vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Affected product/version: IBM OpenPages with Watson v8.1. Remediation: apply 8.1 Interim Fix...

CVE-2020-4423

CVE-2020-4423 concerns IBM Predictive Maintenance and Quality (PMQ) UI where the SSL session cookie (JSESSIONID) is missing the secure attribute, allowing potential exposure of cookies over HTTPS. Affected PMQ versions: 1.0.x, 2.5.x, 2.0.x. Impact: session/cookie theft risk; remediation is to ena...

CVE-2016-6067

IBM Resilient is vulnerable to Stored XSS (CVE-2016-6067). All versions prior to 26.3 are affected. The vulnerability allows authenticated users to inject arbitrary JavaScript into the Web UI, potentially exposing credentials within a trusted session. CVSSv3 base score 5.4. Remediation: upgrade o...

CVE-2016-6064

IBM Resilient stores passwords in clear text, affecting IBM Resilient versions 27.0–28.1. The issue can enable local users with filesystem access to read credentials and potentially escalate privileges or access integrated systems. CVSS Base Score is 6.2 with vector CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S...

CVE-2018-1689

CVE-2018-1689 is an IBM Jazz Foundation cross-site scripting (XSS) vulnerability affecting IBM CLM/Rational products that use Jazz technology. The IBM bulletin enumerates affected suites (e.g., CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM, etc.) and lists CVE-2018-1689 as a vulnerability where ...

CVE-2021-35737

Technical details for CVE-2021-35737 are not provided in the supplied documents. Monitor for updates from official sources.

CVE-2021-44288

Technical details are not publicly available in the provided documents. This CVE entry is reserved; monitor for updates as new information is released.

CVE-2012-0422

CVE-2012-0422 is acknowledged within IBM advisories as part of the Oracle Java SDK-related fixes shipped with WebSphere-related products. The connected IBM pages describe remediation for other CVEs (CVE-2013-0440, CVE-2013-0443, CVE-2013-0169) and list affected WebSphere SDK versions (8.5.x, 8.0....

CVE-2022-35550

The IBM Security Bulletin for CVE-2022-35550 (linked to CVE-2021-35550 in the bulletin) indicates an information-leak vulnerability in IBM Cloud Pak for Multicloud Management Monitoring where Java SE JSSE usage by multiple components could allow an unauthenticated attacker to obtain sensitive inf...

CVE-2022-36371

CVE-2022-36371 is linked to WordPress My Calendar plugin versions

CVE-2019-16742

CVE-2019-16742 is referenced in connected documents related to hashicorp Nomad: Veracode notes an authorization bypass where allocation endpoints improperly perform ACL checks on the requested namespace, enabling potential unauthorized access. No explicit patch/version details or remediation step...

CVE-2019-17591

Bolt CMS 3.x contains a CSRF vulnerability (CVE-2019-17591) demonstrated by public exploits targeting Bolt CMS 3.6.10. The exploit describes an authenticated user CSRF payload that posts to /index.php/async/folder/create to perform actions on behalf of the user. Connected sources show CSRF risk i...

CVE-2019-9887

The connected VERACODE entry describes a Cross-site Scripting (XSS) issue in the johnpbloch/wordpress package, caused by a flawed sanitization path where wp_filter_post_kses is used instead of wp_filter_kses. This allows HTML tags to pass through and be interpreted by the browser. The document do...

CVE-2019-14803

This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2019-15928

HashiCorp Nomad is reported vulnerable to privilege escalation via the raw_exec driver being invoked even when disabled on the client, allowing an authorized user to run a task with higher privileges. The exact affected versions, root cause details, and remediation are not specified in the provid...

CVE-2015-4136

The CVE-2015-4136 entry is supported by Atlassian advisories BAM-16023 (and BAM-16023 cross‑references) describing a vulnerability in Bamboo 5.8.0/5.8.1 where the Windows Stock Image (Windows Server 2012 R2) AMI included a publicly known password for the ‘bamboo’ user. This allowed SSH access to ...