1378 matches found
CVE-2022-3102
CVE-2022-3102 affects the jwcrypto library, where the JWT/JWE handling can allow token substitution that may lead to authentication or authorization bypass. The issue arises from jwcrypto’s ability to auto-detect token types (JWS vs JWE) and, under certain conditions, substitute a signed JWS with...
CVE-2022-41160
The CVE-2022-41160 issue affects FreeRDP (FreeRDP, an open-source RDP implementation). Advisory texts state the vulnerability stems from improper region checks in FreeRDP prior to version 2.4.1, potentially affecting clients using gateway connections. SUSE advisories SUSE-SU-2022:2890-1 and SUSE-...
CVE-2022-1972
Removed by vendor...
CVE-2022-22403
IBM Aspera Faspex 5.0.0 and 5.0.1 are affected by CVE-2022-22403. The root cause is that authorization tokens or session cookies are not set with the Secure attribute, enabling an attacker to snoop cookie values when a user visits an insecure http link or a compromised site. IBM has addressed thi...
CVE-2022-25704
CVE-2022-25704 is listed in the Android/Qualcomm Bluetooth vulnerability set as a high-severity issue affecting Qualcomm closed-source components. Connected sources indicate it is part of the 2022 Android security update; no exploitation details are provided in the supplied documents. Remediation...
CVE-2021-3364
Technical details about CVE-2021-3364 are not publicly available in the provided documents. The Connected Fedora package notices mention libtar updates but do not describe the vulnerability. Monitor for future updates.
CVE-2022-35644
IBM’s advisory documents confirm CVE-2022-35644 is a persistent cross-site scripting vulnerability in IBM Business Process Manager and related IBM Business Automation products. The flaw allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a tru...
CVE-2019-4517
IBM has published multiple advisories for CVE-2019-4517 across its Financial Transaction Manager (FTM) family. The vulnerability is described as a remote open-redirect/phishing vector that can spoof URLs to redirect users to malicious sites. Affected products/versions include: FTM ACH v3.0.6.0–3....
CVE-2019-4599
IBM Sterling Connect:Express for UNIX FTP Server is affected by a heap-based buffer overflow in the FTP service (CVE-2019-4599). The issue arises from improper bounds checking in the ALLO handling of the FTP server, where the static buffer in BSS (rem_file) can overflow when processing input with...
CVE-2020-4637
IBM Resilient App Host (Beta) in Resilient OnPrem IBM Security SOAR was found to use weaker-than-expected cryptographic algorithms, which could allow decryption of highly sensitive information. This is documented under CVE-2020-4637 in IBM’s security bulletin, which identifies the affected produc...
CVE-2017-1796
CVE-2017-1796 affects IBM Rational Developer for System z and IBM Developer for z Systems where weaker cryptographic algorithms could allow decrypting sensitive information (CVSS 5.9, vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Affected products/versions include Rational Developer for S...
CVE-2012-5035
Technical details for CVE-2012-5035 are not publicly available in the provided documents. No affected products, impact, or fixes are stated here. Monitor for updates.
CVE-2020-5028
This CVE (CVE-2020-5028) is documented in IBM’s Security Bulletin for IBM Tivoli/Workload Scheduler. The vulnerability is an XSS issue in the Web UI of IBM Tivoli Workload Scheduler (IBM Workload Scheduler) affecting version 9.3.x and 9.4.x. The root cause is cross-site scripting that could allow...
CVE-2020-4847
IBM Verify Gateway (IVG) contains CVE-2020-4847: when IVG components make API calls, tenant secrets can be exposed (client API secrets, access tokens, cookies) and used to impersonate a tenant. Base score 7.1. Affected IVG versions: RADIUS 1.0.0; PAM 1.0.0, 1.0.1; WinLogin 1.0.0, 1.0.1. Remediati...
CVE-2017-1657
The connected IBM Security Bulletin confirms CVE-2017-1657 affects IBM Resilient, where weaker than expected cryptographic algorithms could allow decrypting highly sensitive information. Affected versions are IBM Resilient 27.0–27.2 and 28.0–28.3. IBM has addressed the issue by updating to versio...
CVE-2017-1627
The IBM bulletin for CVE-2017-1627 states that IBM Resilient is affected by a resource exhaustion issue due to insufficient limits on resources requested or influenced by an actor. Affected versions: IBM Resilient 27.0–27.2 and 28.0–28.3. Impact: potential consumption of more resources than inten...
CVE-2017-1529
CVE-2017-1529 is publicly documented via IBM for Rational DOORS Next Generation with potential for a cross-site scripting (XSS) attack in the Web UI. The IBM bulletin actually references CVE-2018-1529 and affects Rational Requirements Composer 5.0.x (5.0.0–5.0.2) and Rational DOORS Next Generatio...
CVE-2018-1689
CVE-2018-1689 is an IBM Jazz Foundation cross-site scripting (XSS) vulnerability affecting IBM CLM/Rational products that use Jazz technology. The IBM bulletin enumerates affected suites (e.g., CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM, etc.) and lists CVE-2018-1689 as a vulnerability where ...
CVE-2021-29876
Summary : CVE-2021-29876 is implicated in IBM Robotic Process Automation with Automation Anywhere 11.0 via a Lucky Thirteen timing attack on CBC-mode TLS, enabling a MITM to potentially obtain plaintext. Affected version : 11.0. Impact : confidentiality risk (C:H) with no server-side integrity im...