CVE-2023-23480

Summary: CVE-2023-23480 affects IBM Sterling Partner Engagement Manager ( PEM ) versions 6.1, 6.2 and 6.2.1. The vulnerability is a reflected cross-site scripting flaw that lets an attacker inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to credentials ...

CVE-2023-23480 IBM Sterling Partner Engagement Manager cross-site scripting

IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2023-23481 IBM Sterling Partner Engagement Manager cross-site scripting

IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2023-23481

CVE-2023-23481 affects IBM Sterling Partner Engagement Manager ( PEM ) 6.1–6.2.1. The issue is a stored cross-site scripting vulnerability in the Web UI, enabling embedding of arbitrary JavaScript and potentially leading to credentials disclosure within a trusted session. Root cause is a stored X...

CVE-2023-33847

IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a sit...

CVE-2023-33846

IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credential...

CVE-2023-23482

CVE-2023-23482 affects IBM Sterling Partner Engagement Manager (Essential/Standard) versions 6.1, 6.2, and 6.2.1. The issue enables a remote attacker to hijack a user’s click actions (clickjacking) by persuading the victim to visit a malicious site, with potential for adjacent or follow-on attack...

CVE-2023-23482 IBM Sterling Partner Engagement Manager clickjacking

IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch...

CVE-2023-23482 IBM Sterling Partner Engagement Manager clickjacking

IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch...

CVE-2023-33846 IBM CICS TX cross-site scripting

IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credential...

CVE-2023-33847 IBM CICS TX information disclosure

IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a sit...

CVE-2023-33849

IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could transmit sensitive information in query parameters that could be intercepted using man in the middle techniques. IBM X-Force ID: 257105...

Information disclosure

IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could transmit sensitive information in query parameters that could be intercepted using man in the middle techniques. IBM X-Force ID: 257105...

CVE-2023-33849 IBM CICS TX information disclosure

IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could transmit sensitive information in query parameters that could be intercepted using man in the middle techniques. IBM X-Force ID: 257105...

CVE-2023-33849

CVE-2023-33849 affects IBM TXSeries for Multiplatforms (8.1–9.1) and IBM CICS TX variants (Standard 11.1, Advanced 10.1/11.1). The vulnerability enables transmission of highly sensitive information in query parameters that can be intercepted via man‑in‑the‑middle techniques. Impact is described a...

CVE-2023-33848

IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could allow a privileged user to obtain highly sensitive information by enabling debug mode. IBM X-Force ID: 257104...

Code injection

IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could allow a privileged user to obtain highly sensitive information by enabling debug mode. IBM X-Force ID: 257104...

CVE-2023-33848

The CVE-2023-33848 issue affects IBM TXSeries for Multiplatforms (versions 8.1–9.1) and IBM CICS TX products, where enabling debug mode can let a privileged user obtain highly sensitive information. Affected components include IBM TXSeries for Multiplatforms and CICS TX Standard/Advanced (Standar...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to denial of service due to org.glassfish.jersey.core_jersey-common

Summary IBM Sterling Partner Engagement Manager has addressed vulnerability mentioned in CVE by updating to latest versions of libraries. Vulnerability Details IBM X-Force ID: 230016 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an error related to some of the...

Security Bulletin: There are several vulnerabilities with TinyMCE used by IBM Maximo Asset Management

Summary There are several vulnerabilities with TinyMCE used by IBM Maximo Asset Management. Vulnerability Details CVEID:CVE-2022-23494 DESCRIPTION: TinyMCE is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit th...