CVE-2021-33517

CVE-2021-33517 and CVE-2021-36090 are vulnerabilities in Apache Commons Compress that affect IBM WebSphere Liberty (and WebSphere Liberty-based bundles) used in IBM Cloud Pak for Applications and IBM WebSphere Application Server families. The issues cause denial of service through memory-related ...

CVE-2019-4524

IBM Db2 for Linux, UNIX and Windows contains CVE-2019-4524, an information-disclosure vulnerability that exposes remote storage credentials to privileged users after running LOAD or UPDATE ALERT CFG through the ADMIN_CMD() stored procedure. Affected are all fix-pack levels of Db2 V9.7, V10.1, V10...

CVE-2019-4607

IBM InfoSphere Information Governance Catalog and Information Server on Cloud are affected by CVE-2019-4607, a privilege-escalation issue. An authorized user could access governance and information-asset details and modify lineage flows used to calculate data processing. Affected products/version...

CVE-2017-1123

CVE-2017-1123 is an escal ation of privilege in the IBM DS8000 Hardware Management Console (HMC) service interface. The IBM bulletin lists affected models (DS8880/DS8870/DS8800) and indicates affected code levels where exposure exists; a patch set CVE_1Q2018_v1.0 is available to remediate all lis...

CVE-2018-1942

IBM Emptoris Supplier Lifecycle Management (SLM) could disclose highly sensitive information via detailed error messages. Affected versions include 10.0.0.x through 10.1.3.x. Root cause: overly verbose error reporting exposing information in some features. CVSS base score reported as 5.3. Remedia...

CVE-2019-4714

IBM InfoSphere Information Server family is affected by CVE-2019-4714, a cross-site scripting vulnerability that allows embedding arbitrary JavaScript in the Web UI and could lead to credentials disclosure within a trusted session. Affected products/versions include InfoSphere Information Server ...

CVE-2019-4245

CVE-2019-4245 is addressed in IBM Cognos TM1 via an unquoted Windows search path vulnerability that could allow a local user to execute arbitrary code with elevated privileges by placing a malicious file named like a legitimate file. The IBM Security Bulletin for TM1 (and Planning Analytics ecosy...

CVE-2019-4615

IBM InfoSphere Information Server and InfoSphere Information Server on Cloud (version 11.7) are affected by an information disclosure vulnerability identified as CVE-2019-4615. The issue allows exposure of sensitive data via the displayed version numbers of installed software. Affected products r...

CVE-2018-1527

Affected software : IBM i2 Analyst’s Notebook (Premium) versions around 9.0.8. Vulnerability : XML Entity Injection (XXE) when processing XML during import (Cellebrite, XRY, Notebook Exchange from the Import menu). Root cause : processing XML data with external entities that can call out to exter...

CVE-2019-4221

IBM Cognos Analytics is affected by CVE-2019-4221 via DOM-based link manipulation. Affected products include IBM Cognos Analytics 11.1 and 11.0. The issue allows an attacker to manipulate links in the Web UI to facilitate various attacks. remediation is to apply the provided fixes: Cognos Analyti...

CVE-2018-1960

The MaaS360 iOS Application (versions

CVE-2017-1464

IBM TRIRIGA is affected by CVE-2017-1464 due to the failure to enable HTTP Strict Transport Security (HSTS), enabling a remote attacker to obtain sensitive information via man-in-the-middle techniques. Affected IBM TRIRIGA Platform versions include 3.5.0–3.5.3.0, 3.4.0–3.4.2.5, and 3.3.0–3.3.2.5....

CVE-2020-20353

CVE-2020-20353: IBM WebSphere Application Server in IBM Cloud is affected by an XML External Entity (XXE) Injection vulnerability. Affected product: IBM WebSphere Application Server in IBM Cloud (WebSphere Application Server 9.0 and 8.5). The IBM bulletin directs readers to the security bulletin(...

CVE-2019-4610

CVE-2019-4610 affects IBM Cloud Private Identity and Access Management. The IBM bulletin states the issue arises from use of an API key that grants access to a resource type, enabling an authenticated attacker to access other resources of the same type beyond the intended scope. Affected product/...

CVE-2019-4445

IBM Security Bulletin aggregates CVE-2019-4445 under the IBM Rational CLM/RQM/RTC family. Affected products and versions include Rational CLM 6.0–6.0.6.1, Rational Quality Manager 6.0–6.0.6.1, Rational Team Concert 6.0–6.0.6.1, Rational DOORS Next Generation 6.0–6.0.6.1, Rational Engineering Life...

CVE-2020-4538

CVE-2020-4538 affects IBM Security Identity Manager (ISIM) 6.0.0. The vulnerability arises from reuse of another user’s JSESSIONID, enabling a privileged local user to perform unauthorized actions. IBM's bulletin confirms the issue and assigns a CVSS Base score of 6.7. Remediation provided: upgra...

CVE-2019-4677

IBM Security Identity Manager is affected by CVE-2019-4677 due to a cross-site scripting vulnerability in the Web UI. The bulletin specifies IBM Security Identity Manager 6.0.0 as affected, with the fix available in version 6.0.0-ISS-SIM-FP0023. The vulnerability allows embedding arbitrary JavaSc...

CVE-2020-4939

IBM Jazz for Service Management (JazzSM) is vulnerable to Stored Cross-Site Scripting (CVE-2020-4939) affecting WebGUI 8.1.0 GA/FP and JazzSM 1.1.3. The vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. A fix...

CVE-2017-1547

CVE-2017-1547 affects IBM Emptoris Services Procurement. The vulnerability enables username enumeration through the forgot-password flow, allowing an attacker to determine valid usernames and potentially brute-force credentials. This concerns IBM Emptoris Services Procurement 10.0.0.x. Root cause...

CVE-2011-0068

CVE-2011-0068: The connected documentation details memory safety issues in Firefox’s WebGL/WebGLES components that could be exploited to run arbitrary code. Mozilla’s MFSA 2011-17 describes two crashes in WebGL/WebGLES that could be triggered to execute code, fixed in Firefox 4.0.1. OpenSUSE advi...