CVE-2019-4221

IBM Cognos Analytics is affected by CVE-2019-4221 via DOM-based link manipulation. Affected products include IBM Cognos Analytics 11.1 and 11.0. The issue allows an attacker to manipulate links in the Web UI to facilitate various attacks. remediation is to apply the provided fixes: Cognos Analyti...

CVE-2017-1399

CVE-2017-1399 affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance. The vulnerability stems from weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Affected IGI releases include 5.2, 5.2.1, 5.2.2, 5.2.2....

CVE-2017-1464

IBM TRIRIGA is affected by CVE-2017-1464 due to the failure to enable HTTP Strict Transport Security (HSTS), enabling a remote attacker to obtain sensitive information via man-in-the-middle techniques. Affected IBM TRIRIGA Platform versions include 3.5.0–3.5.3.0, 3.4.0–3.4.2.5, and 3.3.0–3.3.2.5....

CVE-2020-20353

CVE-2020-20353: IBM WebSphere Application Server in IBM Cloud is affected by an XML External Entity (XXE) Injection vulnerability. Affected product: IBM WebSphere Application Server in IBM Cloud (WebSphere Application Server 9.0 and 8.5). The IBM bulletin directs readers to the security bulletin(...

CVE-2019-4610

CVE-2019-4610 affects IBM Cloud Private Identity and Access Management. The IBM bulletin states the issue arises from use of an API key that grants access to a resource type, enabling an authenticated attacker to access other resources of the same type beyond the intended scope. Affected product/...

CVE-2019-4037

CVE-2019-4037 affects IBM Security Access Manager Appliance. The IBM advisory states that an authenticated user could execute commands with the appliance admin credentials, impacting IBM Security Access Manager versions 9.0.1.0 through 9.0.5.0 (on appliances). The vulnerability’s CVSS base score ...

CVE-2019-4445

IBM Security Bulletin aggregates CVE-2019-4445 under the IBM Rational CLM/RQM/RTC family. Affected products and versions include Rational CLM 6.0–6.0.6.1, Rational Quality Manager 6.0–6.0.6.1, Rational Team Concert 6.0–6.0.6.1, Rational DOORS Next Generation 6.0–6.0.6.1, Rational Engineering Life...

CVE-2019-4634

CVE-2019-4634 affects IBM Security Secret Server (all versions). The IBM security bulletin and Symantec writeup describe information-disclosure vulnerabilities where an attacker could learn details about underlying technologies through headers and response data (e.g., X-Powered-By, X-ASPNET-VERSI...

CVE-2020-4844

CVE-2020-4844 is addressed in IBM Security Identity Governance and Intelligence (IGI) 5.2.6. The IBM Security Directory Integrator component used by IGI had hard coded credentials, which has been removed in the fix. Affected product: IBM Security Identity Governance and Intelligence, version 5.2....

CVE-2019-4490

CVE-2019-4490 concerns IBM UrbanCode Deploy (UCD). A security vulnerability allows maliciously crafted data in UCD to generate a malicious CSV download file when opened with certain third‑party tools. IBM’s bulletin notes affected products as UCD (all versions) with CVSS base score 7.8, and lists...

CVE-2018-1591

IBM Multi-Cloud Data Encryption (MDE) is affected by CVE-2018-1591 due to an application error that causes error messages to disclose sensitive information about the environment, users, or data. Affected versions are MDE 2.1 through 2.1.0.1. The remediation is to upgrade to MDE 2.1.0.2 (Multiplat...

CVE-2020-4538

CVE-2020-4538 affects IBM Security Identity Manager (ISIM) 6.0.0. The vulnerability arises from reuse of another user’s JSESSIONID, enabling a privileged local user to perform unauthorized actions. IBM's bulletin confirms the issue and assigns a CVSS Base score of 6.7. Remediation provided: upgra...

CVE-2019-4498

CVE-2019-4498 affects IBM Secure Gateway Client versions 1.8.0.0–1.8.2.2. The vulnerability arises from weaker-than-expected cryptographic algorithms used by the Secure Gateway Service, which could allow decryption of highly sensitive information. Remediation: upgrade to Secure Gateway Client 1.8...

CVE-2020-204480

CVE-2020-204480 is a Server-side Request Forgery (SSRF) vulnerability affecting IBM WebSphere Application Server when shipped with IBM Security Identity Manager (ISIM). Affected product: ISIM 6.0.0 with WAS 7.0 and 8.5. Remediation/fixes are described in IBM security bulletins; no workarounds are...

CVE-2020-29754

CVE-2020-29754 is a privilege escalation vulnerability in IBM WebSphere Application Server shipped with IBM Security Identity Manager (ISIM). Affected ISIM versions: 6.0.0 and 6.0.2. Affected WAS versions: WAS 7.0 and 8.5 for ISIM 6.0.0; WAS 9 for ISIM 6.0.2. Remediation/fixes are listed in the b...

CVE-2019-4643

Technical details for CVE-2019-4643 are not publicly available in the provided documents. Monitor for updates.

CVE-2021-4575

CVE-2021-4575 is a cross-site scripting vulnerability affecting IBM WebSphere Application Server (WAS) ND traditional, as referenced in IBM security bulletins about WAS shipped with IBM Security Directory Server. The connected IBM bulletin indicates affected WAS 8.5 and references the remediation...

CVE-2011-4065

Technical details for CVE-2011-4065 are not provided in the connected documents. The Initial Description indicates reservation with no public details. Monitor for updates.

CVE-2108-6150

The connected Gentoo GLSA (GLSA-201808-01) confirms multiple vulnerabilities in Chromium and Google Chrome. A remote attacker could escalate privileges, trigger a heap buffer overflow, obtain sensitive information, or spoof a URL. The advisory provides remediation by upgrading to Chromium >= 6...

CVE-2020-19599

CVE-2020-19599 is covered within a Gentoo advisories set on Binutils: Multiple vulnerabilities. The connected Gentoo GLSA-202107-24 references CVE-2020-19599 among other CVEs and notes multipleBinutils vulnerabilities with no workaround availability. The Gentoo advisory recommends upgrading Binut...