Design/Logic Flaw

IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 does not properly implement secure connections, which allows man-in-the-middle attackers to discover cleartext credentials via unspecified vectors...

CVE-2014-4830

IBM QRadar, QRM, and QVM are affected by CVE-2014-4830 due to failure to set the HTTPOnly flag on the session cookie in web interfaces. This allows script access to the cookie, potentially exposing sensitive information. Affected versions include IBM QRadar/QRM/QVM 7.2 MR2 and QRadar/QRM 7.1 MR1,...

CVE-2014-4825

Summary of CVE-2014-4825 (IBM QRadar/QRM/QVM) : IBM QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 are reported to handle secure connections improperly, enabling an attacker to obtain cleartext credentials via unspecified vectors. The IBM bulletin lists affected products as IBM QRadar / QRM / QVM, w...

CVE-2014-4827

CVE-2014-4827 is an XSS vulnerability affecting IBM QRadar-related products. The vulnerability arises from improper validation of user-supplied input, allowing a remote attacker to craft a URL that injects arbitrary web script or HTML in QRadar’s web interface. Affected products include IBM QRada...

CVE-2014-4828

The CVE-2014-4828 issue affects IBM QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2, where remote attackers can perform clickjacking via a crafted HTTP request. Root cause is improper handling of click actions in the web interface, enabling a malicious site to hijack user clicks. Affected products ar...