CVE-2023-0884

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-3759. Reason: This candidate is a reservation duplicate of CVE-2022-3759. Notes: All CVE users should reference CVE-2022-3759 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

CVE-2019-4516

CVE-2019-4516 affects IBM Security Key Lifecycle Manager (SKLM) v3.0 through v3.0.0.3 and v3.0.1 through v3.0.1.2. The vulnerability arises from the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Mitigation provided by ...

CVE-2018-1613

CVE-2018-1613 is a confirmed vulnerability in IBM Platform Symphony and IBM Spectrum Symphony involving a vertical authorization bypass in the Symping utility. A local attacker could obtain a privileged token and gain privileges or access highly sensitive data. Affected products/versions: IBM Pla...

CVE-2016-6907

CVE-2016-6907 affects F5 BIG-IP TMM SSL/TLS virtual servers using CBC ciphers, enabling a Vaudenay timing/padding oracle attack to potentially reveal plaintext. vulnerable platforms include BIG-IP on Cavium Nitrox with CBC ciphers (not AES-GCM or RC4); also impacts BIG-IP VE/cloud and specific ha...

CVE-2018-1714

The IBM bulletin confirms CVE-2018-1714 affects IBM Cloud Private 2.1.0 where any user authorized to deploy a Helm chart can install an unsafe chart that runs with privileges greater than the Helm user’s. Impact is privilege escalation within the cluster, with CVSS Base Score 7. Remediation: upgr...

CVE-2018-1769

CVE-2018-1769 affects IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center). The vulnerability occurs when tracing is enabled for OC_TASKS, causing the monitoring ID password to be written in plaintext to trace files. Affected versions are 8.1.0.000–8.1.6.100 ...

CVE-2018-1855

CVE-2018-1855 is an IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center) cross-site scripting vulnerability. Versions affected: 8.1.0.000–8.1.6.100 and 7.1.0.000–7.1.9.100. The flaw allows a remote attacker to inject arbitrary JavaScript into the Web UI, pote...

CVE-2018-1854

IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center) is affected by CVE-2018-1854: a cross-site scripting vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. Affected versions are 8.1.0.000–8.1.6.100 and 7.1.0.000–7.1...

CVE-2021-32861

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-32856. Reason: This candidate is a reservation duplicate of CVE-2021-32856. Notes: All CVE users should reference CVE-2021-32856 instead of this candidate. All references and descriptions in this candidate have been removed t...

CVE-2018-1590

IBM Multi-Cloud Data Encryption (MDE) is affected by CVE-2018-1590: it does not invalidate session tokens in a timely manner, potentially allowing attackers with local access to log into a closed browser session. Affected versions: MDE 2.1–2.1.0.1. Remediation: upgrade to MDE 2.1.0.2 (Multi-Cloud...

CVE-2018-1589

CVE-2018-1589 is documented in IBM’s Multi-Cloud Data Encryption (MDE) security bulletin as a denial-of-service vulnerability. The issue occurs because MDE does not properly restrict the size or amount of resources requested or influenced by an actor, allowing resource consumption beyond intended...

CVE-2018-1592

CVE-2018-1592 (IBM Multi-Cloud Data Encryption, MDE) is an information-exposure vulnerability caused by storing sensitive data in URL parameters. The IBM reports show affected MDE versions: 2.1-2.1.0.1 and 2.1-2.1.0.2, with remediation available via upgrade to 2.1.0.2 (for 2.1 line) or to 2.2.0.0...

CVE-2017-1579

CVE-2017-1579 is addressed in IBM DOORS Next Generation (DNG/RRC). The IBM Security Bulletin reports a cross-site scripting vulnerability in the Web UI of Rational DOORS Next Generation, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted sessi...

CVE-2012-1359

CVE-2012-1359, as reserved, has a connected IBM advisory detailing multiple security vulnerabilities in IBM JRE 7.0 SR2 or earlier (and non-IBM Java 7.0 when used with Rational Functional Tester). The bulletin lists numerous CVEs (e.g., CVE-2012-3159 and related issues across JRE components such ...

CVE-2016-6109

CVE-2016-6109 is a cross-site scripting vulnerability in IBM Business Process Manager (BPM) used with IBM Cloud Orchestrator/Enterprise. IBM advisories (IBM BPM/Cloud Orchestrator links) enumerate affected BPM/Cloud Orchestrator versions and state the vulnerability allows embedding arbitrary Java...

CVE-2016-9974

IBM Security Guardium Database Activity Monitor is affected by CVE-2016-9974: a shell injection in the CLI 'support execute' command could allow a locally authenticated attacker to execute arbitrary commands. Affected versions include Guardium v9.x and v10.x (up to 10.1.2). The root cause is comm...

CVE-2017-16032

CVE-2017-16032 is a DoS vulnerability in the brace-expansion component used by IBM MobileFirst Platform Foundation 8.x.x. The IBM bulletin lists brace-expansion as vulnerable to regular expression denial of service (ReDoS) via crafted arguments, with affected versions tied to IBM MobileFirst Plat...

SUSE CVE-2006-2657

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-3017. Reason: This candidate is a reservation duplicate of CVE-2006-3017. Notes: All CVE users should reference CVE-2006-3017 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

SUSE CVE-2008-2373

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-2863. Reason: This candidate is a reservation duplicate of CVE-2008-2863. Notes: All CVE users should reference CVE-2008-2863 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

SUSE CVE-2008-2804

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-2800. Reason: This candidate is a reservation duplicate of CVE-2008-2800. Notes: All CVE users should reference CVE-2008-2800 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...