CVE-2017-10516

CVE-2017-10516 is linked to a cross-site scripting (XSS) vulnerability in Pallets Werkzeug prior to 0.11.11. The issue resides in the render_full function within the debug/tbtools.py debugger, allowing remote attackers to inject arbitrary script/HTML via an exception message. Affected product/ver...

CVE-2014-1197

CVE-2014-1197 concerns GNU Cpio 2.11 where the --no-absolute-filenames option can be bypassed via symlinks during extraction, allowing rogue archives to write files outside the current directory. Mageia MGASA-2015-0080 documents this issue (CVE-2014-1197) and references a fix in updated cpio pack...

CVE-2018-1832

IBM Event Streams 2018.3.0 and 2018.3.1 are affected by CVE-2018-1832, where a remote attacker could bypass security restrictions by modifying the UI session cookie after authentication, potentially exposing user and session data during an encrypted session. The remediation is to upgrade to IBM E...

Cross Site Scripting (XSS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

Denial Of Service (DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2020-17639

The IBM SDK, Java Technology Edition Security Bulletin documents CVE-2020-17639 as part of a set of Java SE issues disclosed in the July 2020 CP Update. Affected IBM releases are: 7.0.0.0–7.0.10.65, 7.1.0.0–7.1.4.65, and 8.0.0.0–8.0.6.11. Remediation is provided through newer builds: 7.0.10.70, 7...

CVE-2010-0474

CVE-2010-0474 is listed as part of Debian WebKit vulnerabilities in DSA-2188-1. The affected package is webkit (GTK+ WebKit), with multiple CVEs including CVE-2010-0474. Debian states these problems were fixed in the stable distribution (squeeze) with version 1.2.7-0+squeeze1 (and 1.2.7-1 for whe...

CVE-2021-22099

Cloud Foundry CVE-2021-22099 is a Server-Side Request Forgery (SSRF) in the Cloud Controller. Malicious users can trigger HTTP GET requests to internal CF components and read responses. Affected products and versions: CAPI all versions before 1.114.0; CF Deployment all versions before 16.23.0. Mi...

Denial Of Service (DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2017-1095

CVE-2017-1095 affects IBM Jazz Reporting Service’s Lifecycle Query Engine (LQE). The IBM Security Bulletin reports a cross-site scripting vulnerability in JRS, enabling a user to embed arbitrary JavaScript in the Web UI and potentially disclose credentials within a trusted session. Affected produ...

CVE-2021-33517

CVE-2021-33517 and CVE-2021-36090 are vulnerabilities in Apache Commons Compress that affect IBM WebSphere Liberty (and WebSphere Liberty-based bundles) used in IBM Cloud Pak for Applications and IBM WebSphere Application Server families. The issues cause denial of service through memory-related ...

CVE-2020-4720

IBM Daeja ViewONE Professional, Standard & Virtual (5.0CD) could allow an authenticated user to obtain sensitive information from documents they should not access due to cached content exposure. Remediation: apply fixes in ViewONE Virtual 5.0.7 iFix009 or 5.0.8 iFix003. The fix relies on the cont...

CVE-2018-1687

IBM API Connect is vulnerable to a denial-of-service (CVE-2018-1687) due to a lack of rate limiting in the TCP listener. A remote attacker could launch a TCP SYN flood to exhaust CPU and memory. Affected: IBM API Connect versions 5.0.0.0–5.0.8.3. Remediation: upgrade to IBM API Connect Developer ...

CVE-2019-4524

IBM Db2 for Linux, UNIX and Windows contains CVE-2019-4524, an information-disclosure vulnerability that exposes remote storage credentials to privileged users after running LOAD or UPDATE ALERT CFG through the ADMIN_CMD() stored procedure. Affected are all fix-pack levels of Db2 V9.7, V10.1, V10...

CVE-2017-1123

CVE-2017-1123 is an escal ation of privilege in the IBM DS8000 Hardware Management Console (HMC) service interface. The IBM bulletin lists affected models (DS8880/DS8870/DS8800) and indicates affected code levels where exposure exists; a patch set CVE_1Q2018_v1.0 is available to remediate all lis...

CVE-2018-1942

IBM Emptoris Supplier Lifecycle Management (SLM) could disclose highly sensitive information via detailed error messages. Affected versions include 10.0.0.x through 10.1.3.x. Root cause: overly verbose error reporting exposing information in some features. CVSS base score reported as 5.3. Remedia...

CVE-2012-3339

CVE-2012-3339 is an XML External Entity (XXE) vulnerability in IBM InfoSphere Guardium. The issue allows remote authenticated users to obtain sensitive information, specifically via an error report that can reveal server file contents (including a database password). Affected platforms include IB...

CVE-2019-4042

IBM Sterling B2B Integrator is affected by CVE-2019-4042 through a permission-control vulnerability that could allow a user without proper permissions to access EBICS configuration using their own secure token. Affected versions are IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0. Remediation...

CVE-2019-4714

IBM InfoSphere Information Server family is affected by CVE-2019-4714, a cross-site scripting vulnerability that allows embedding arbitrary JavaScript in the Web UI and could lead to credentials disclosure within a trusted session. Affected products/versions include InfoSphere Information Server ...

CVE-2018-1527

Affected software : IBM i2 Analyst’s Notebook (Premium) versions around 9.0.8. Vulnerability : XML Entity Injection (XXE) when processing XML during import (Cellebrite, XRY, Notebook Exchange from the Import menu). Root cause : processing XML data with external entities that can call out to exter...