CVE-2022-35721

IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2022-40748

Summary: CVE-2022-40748 affects IBM InfoSphere Information Server 11.7 and is a cross-site scripting vulnerability that could allow embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The public IBM advisory confirms affected produ...

CVE-2022-35721: Improper Neutralization of Input During Web Page Generation

IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

PT-2022-25508

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server version 11.7 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

CVE-2022-40748: Improper Neutralization of Input During Web Page Generation

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236586...

CVE-2022-41224

A flaw was found in the Jenkins package. Jenkins does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI. This issue results in a stored Cross-site scripting XSS vulnerability, exploitable by attackers able to control tooltips for this component...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2016-5902)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerability Details CVEID:...

CVE-2022-41224: Improper Neutralization of Input During Web Page Generation

Jenkins 2.367 through 2.369 both inclusive does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control tooltips for this component...

PT-2022-25739 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.367 through 2.369 Description: The issue results in a stored cross-site scripting XSS vulnerability due to the lack of escaping tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI. This...

PT-2022-6148

Name of the Vulnerable Software and Affected Versions IBM Jazz for Service Management version 1.1.3 Description The issue is related to stored cross-site scripting, allowing users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to...

Security Bulletin: Cross-site scripting vulnerability in IBM Business Automation Workflow and IBM Business Process Manager (BPM) (CVE-2019-4149)

Summary A cross-site scripting vulnerability in IBM Business Automation Workflow and IBM BPM has been found. Vulnerability Details CVEID: CVE-2019-4149 DESCRIPTION: IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip...

Security Bulletin: Cross-site scripting in IBM Business Automation Workflow and IBM Business Process Manager (BPM) (CVE-2019-4204)

Summary A cross-site scripting vulnerability in IBM Business Automation Workflow and IBM BPM has been found. Vulnerability Details CVEID: CVE-2019-4204 DESCRIPTION: IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip...

CVE-2022-34336

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2022-34336: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2022-36736

Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor...

CVE-2022-36736

Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor...

Design/Logic Flaw

DISPUTED Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor...

CVE-2022-36736

CVE-2022-36736 affects Jitsi (version 2.10.5550) with a clickjacking vulnerability in the web UI due to a crafted HTTP request. Several sources (NVD/Red Hat/CVE records, CNNVD, PT-Security) confirm the issue and its presence in 2.10.5550, though the vendor disputes it. Impact is described as enab...

CVE-2022-36736

Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor...

CVE-2022-36736: Improper Restriction of Rendered UI Layers or Frames

Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor...