CVE-2020-4778

CVE-2020-4778 affects IBM Cúram Social Program Management, with vulnerable tokens hashed using MD5 in 7.0.9 and 7.0.10. Root cause: MD5 hashing of a token in a single instance, weaker than SHA-256 currently used in the app. Impact described by IBM: CVSS base score 5.9; confidentiality impact high...

CVE-2020-4774

The CVE-2020-4774 issue concerns IBM Cúram Social Program Management (Curam SPM) versions 7.0.9 and 7.0.10, where an XPath vulnerability arises from improper handling of user-supplied input. This could allow a remote attacker to obtain unauthorized access or disclose XML document structure/conten...

CVE-2020-4774

An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information su...

CVE-2020-4775

A cross-site scripting XSS vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user's device, restricted to a single location. IB...

CVE-2020-4776

A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted file path in URL request to view arbitrary files on the system. IBM X-Force ID:...

CVE-2020-4775

The connected IBM IBM Cúram/Curam vulnerability entry CVE-2020-4775 is an XSS issue that affects Curam Social Program Management versions 7.0.9 and 7.0.10. The IBM security bulletin corroborates the affected products/versions and describes the impact as attackers injecting malicious scripts into ...

CVE-2020-4776

CVE-2020-4776 is a path traversal vulnerability affecting IBM Cúram Social Program Management 7.0.9 and 7.0.10. A remote attacker could craft a URL path to view arbitrary files on the system. Remediation: upgrade to 7.0.10 iFix2 or to a later 7.0.10 release, or 7.0.9 iFix5 or later. Affected prod...

CVE-2020-4773

A cross-site request forgery CSRF vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to execute unwanted actions on the web application while they are currently authenticated. This applies to a single server class only, with no...

CVE-2020-4773

CVE-2020-4773 is a CSRF vulnerability affecting IBM Cúram Social Program Management (Curam SPM) versions 7.0.9 and 7.0.10. The issue is a cross-site request forgery that could force authenticated users to perform unwanted actions on the application, limited to a single server class with no impact...

CVE-2020-4772

The CVE-2020-4772 XXE vulnerability affects IBM Cúram Social Program Management (Curam SPM) 7.0.9 and 7.0.10. The root cause is an XML External Entity Injection flaw in Curam SPM components, leading to potential exposure of sensitive data and the possibility of DoS, SSRF, or memory/resource exhau...

PT-2020-18239

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 7.0.9 through 7.0.10 Description A path traversal issue may allow a remote attacker to traverse directories on the system by sending a specially-crafted file path in a URL request, potentially...

CVE-2020-4774: XML Injection (aka Blind XPath Injection)

An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information su...

PT-2020-18240

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 7.0.9 through 7.0.10 Description The issue concerns the use of the MD5 algorithm for hashing tokens in a single instance, which is considered less secure than the default SHA-256 cryptographic...

PT-2020-18241

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 7.0.9 through 7.0.10 Description A HTTP Verb Tampering issue may allow an attacker to bypass security access controls by sending a specially-crafted request. Recommendations For versions 7.0.9 and...

PT-2020-18243

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 7.0.9 through 7.0.10 Description The issue is related to improper input validation before calling the java readLine method, which could result in a denial of service. Recommendations For versions...

PT-2020-18236

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 7.0.9 through 7.0.10 Description A cross-site request forgery CSRF issue may force a user to execute unwanted actions on the web application while they are currently authenticated. This issue applie...

PT-2020-18242

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 7.0.9 through 7.0.10 Description The issue is related to the OOTB build scripts not setting the secure attribute on session cookies. This may allow unauthorized parties to observe cookies...

PT-2020-18237

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 7.0.9 through 7.0.10 Description The issue is caused by the improper handling of user-supplied input, potentially allowing a remote attacker to obtain unauthorized access or reveal sensitive...

CVE-2020-4780: Insufficient Session Expiration

OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158...

CVE-2020-4779: Improper Authentication

A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass security access controls. IBM X-Force ID: 189156...