IBM Engineering Requirements Management DOORS Next – Cross-site Scripting Vulnerabilities

IBM Engineering Requirements Management DOORS is a requirements management tool. A cross-site scripting vulnerability exists in IBM Engineering Requirements Management DOORS, which can be exploited by an attacker to embed arbitrary JavaScript code in the Web UI...

PT-2024-27222

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A CP interrupt bug in the Linux kernel causes bad packet garbage exception codes to be raised. To address this, a range check has been implemented to prevent the debugger and runtime fro...

PYSEC-2024-245

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk...

PT-2024-2161 · Ibm · Ibm Engineering Test Management

Name of the Vulnerable Software and Affected Versions: IBM Engineering Test Management versions 7.0.2 through 7.0.3 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a...

Mozilla Firefox Thunderbird Code Execution

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to an incorrect limitation on the number of user interface layers or frames that can be displayed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2023-50303

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 273333...

PT-2024-2053 · Ibm · Ibm Engineering Requirements Management Doors

Name of the Vulnerable Software and Affected Versions: IBM Engineering Requirements Management versions 9.7.2.7 Description: The issue exists due to insufficient protection of the web page structure, allowing a remote attacker to exploit it and potentially disclose protected information. This...

Mozilla Firefox Thunderbird Spear Phishing

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to information representation errors in the user interface. Exploiting these vulnerabilities can allow attackers to perform spear-phishing attacks using full-screen notifications...

Microsoft Azure Active Directory B2C Information Disclosure

The vulnerability of the Microsoft Azure Active Directory B2C access and identity management service is related to information representation errors in the user interface. Exploiting this vulnerability could allow a malicious actor to perform spear-phishing attacks remotely...

GitLab Authentication Bypass UI Settings

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to modify the settings of the user interface for project...

CVE-2024-0551 Download and export of file via default user role

Enable exports of the database and associated exported information of the system via the default user role. The attacked would have to have been granted access to the system prior to the attack. It is worth noting that the deterministic nature of the export name is lower risk as the UI for...

PT-2024-13894 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Microsoft Edge Android Information Disclosure

The vulnerability of Microsoft Edge browser on Android is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform a spear-phishing attack...

CVE-2023-38359

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

IBM Cognos Analytics cross-site scripting vulnerabilities

IBM Cognos Analytics is a suite of business intelligence software from International Business Machines IBM. A cross-site scripting vulnerability exists in the IBM Cognos Analytics Web UI, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtain...

IBM Cognos Analytics cross-site scripting vulnerabilities

IBM Cognos Analytics is a suite of business intelligence software from International Business Machines IBM. A cross-site scripting vulnerability exists in the IBM Cognos Analytics Web UI, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to obtain...

PT-2024-13075 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.1.7 through 12.0.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Security Bulletin: IBM Sterling Connect:Direct Browser User Interface has multiple vulnerabilities due to IBM Java

Summary Sterling Connect:Direct Browser User Interface uses IBM® Runtime Environment Java™ Versions. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE...

Security Bulletin: IBM Sterling Connect:Direct Browser User Interface has multiple vulnerabilities due to IBM Java

Summary Sterling Connect:Direct Browser User Interface uses IBM® Runtime Environment Java™ Versions. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-22045 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM compone...

PT-2024-1826 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge affected versions not specified Description: The issue is related to errors in the representation of information by the user interface, which can be exploited by a remote attacker to perform a spoofing attack. Recommendations: ...