2283 matches found
BlurExchange Contract May Not Be Upgradeable
Lines of code Vulnerability details Vulnerability Details The BlurExchange is designed to be an implementation contract supporting an upgradeable feature. However, we found that some contracts define state variables without allocating the reserved storage slots gap which may impede the BlurExchan...
CVE-2021-39673
CVE-2021-39673 is publicly documented in Android bulletin contexts as a high-severity issue listed under the 2022-10 patch levels for Android 13 (AOSP 13). Connected documents show it alongside other CVEs with Android patch-level mappings (e.g., CVE-2022-20419 and CVE-2022-20412) and explicitly c...
PT-2022-34605 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.9 Description: The issue concerns a potential security vulnerability in the Linux Kernel. It is related to the regmap: spi, where space for register address/padding is reserved. The actual impact and attac...
CVE-2019-4662
IBM FileNet Content Manager and Case Foundation ACCE contain multiple vulnerabilities including CVE-2019-4662. Affected: FileNet Content Manager and Case Foundation 5.5.2 and 5.5.3. Root cause: authorization tokens or session cookies are not marked as Secure, allowing cookie leakage over insecure...
CVE-2019-4717
IBM Jazz for Service Management (JazzSM) is affected by a cross-site scripting (XSS) vulnerability (CVE-2019-4717) in version 1.1.3. The issue enables a remote attacker to inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to credentials disclosure within ...
CVE-2019-4532
CVE-2019-4532 affects IBM Resilient OnPrem. The vulnerability exists in IBM Resilient versions 33.x and 34.0 where the platform does not properly limit the number or frequency of interactions with an actor (e.g., password reset requests). This could enable abuse of reset flows. Remediation: upgra...
CVE-2019-4097
CVE-2019-4097 is a spoofing vulnerability in Platform System Manager (PSM) shipped with IBM Cloud Pak System/PureApplication System. An authenticated user could steal or manipulate customer sessions and cookies. Affected product: IBM Cloud Pak System (V2.3.0). CVSS Base score 4.3. Remediation: up...
CVE-2019-4096
CVE-2019-4096 is an IBM Cloud Pak System vulnerability describing inadequate account lockout settings that could allow remote brute-forcing of credentials. IBM Cloud Pak System V2.3.0 is affected; remediation is to upgrade to V2.3.0.1. The IBM security bulletins note the vulnerability is resolved...
CVE-2022-1972
Removed by vendor...
CVE-2022-22403
IBM Aspera Faspex 5.0.0 and 5.0.1 are affected by CVE-2022-22403. The root cause is that authorization tokens or session cookies are not set with the Secure attribute, enabling an attacker to snoop cookie values when a user visits an insecure http link or a compromised site. IBM has addressed thi...
CVE-2022-25704
CVE-2022-25704 is listed in the Android/Qualcomm Bluetooth vulnerability set as a high-severity issue affecting Qualcomm closed-source components. Connected sources indicate it is part of the 2022 Android security update; no exploitation details are provided in the supplied documents. Remediation...
CVE-2022-35958
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-37458. Reason: This candidate is a reservation duplicate of CVE-2022-37458. Notes: All CVE users should reference CVE-2022-37458 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...
CVE-2019-4518
CVE-2019-4518 is associated with IBM Financial Transaction Manager family (Digital Payments, Corporate Payment Services, ACH, Check services). The connected IBM security bulletins confirm a validation weakness where input is not properly validated, potentially allowing an authenticated user to is...
CVE-2020-4275
CVE-2020-4275: Cross-site scripting in the Carbon Black Response add-on for IBM QRadar SIEM. Affects Carbon Black Response versions 1.0.1–1.3.0. The vulnerability allows injecting arbitrary JavaScript into the Web UI, potentially leaking credentials within a trusted session. Root cause: improper ...
CVE-2019-4599
IBM Sterling Connect:Express for UNIX FTP Server is affected by a heap-based buffer overflow in the FTP service (CVE-2019-4599). The issue arises from improper bounds checking in the ALLO handling of the FTP server, where the static buffer in BSS (rem_file) can overflow when processing input with...
CVE-2019-14661
Summary : IBM Operations Analytics Predictive Insights is affected by CVE-2019-14661 (and related Jackson-databind CVEs). The IBM security bulletins state that Jackson-databind is used (limited to the REST Mediation utility) and that the product has been addressed for these CVEs. Affected product...
CVE-2020-4637
IBM Resilient App Host (Beta) in Resilient OnPrem IBM Security SOAR was found to use weaker-than-expected cryptographic algorithms, which could allow decryption of highly sensitive information. This is documented under CVE-2020-4637 in IBM’s security bulletin, which identifies the affected produc...
CVE-2020-4443
IBM OpenPages with Watson is affected by CVE-2020-4443 (XSS). The vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Affected product/version: IBM OpenPages with Watson v8.1. Remediation: apply 8.1 Interim Fix...
CVE-2020-4440
IBM OpenPages with Watson has addressed CVE-2020-4440, a reverse tabnabbing vulnerability. An authenticated user could replace a page with a phishing site to harvest sensitive information. Affected product: IBM OpenPages with Watson v8.1. CVSS Base score 6.5. Remediation: apply IBM OpenPages with...