CVE-2020-5001

IBM Financial Transaction Manager versions 3.2.0–3.2.7 are affected by a directory traversal vulnerability that allows a remote attacker to view arbitrary files by sending URL requests containing dot dot sequences (/../). The issue is described across multiple sources as a path traversal flaw wit...

CVE-2022-43902

IBM MQ CVE-2022-43902 affects IBM MQ 9.1 LTS/CD, 9.2 LTS/CD, and 9.3 LTS/CD. The vulnerability enables a denial-of-service through specially crafted PCF or MQSC messages, with the issue traced to the IBM MQ Server component. Remediations (APAR IT42613) are available: upgrade to 9.3.1.1 for 9.1/9....

Code injection

IBM HTTP Server 8.5 used by IBM WebSphere Application Server could allow a remote user to cause a denial of service using a specially crafted URL. IBM X-Force ID: 248296...

Security Bulletin: IBM Planning Analytics and IBM Planning Analytics Workspace are affected by a security vulnerability in IBM WebSphere Application Server Liberty (CVE-2022-34165)

Summary There is a vulnerabilty in IBM WebSphere Application Server Liberty used by IBM Planning Analytics and IBM Planning Analytics Workspace. The applicable CVE has been addressed in IBM Planning Analytics and Planning Analytics Workspace. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION...

CVE-2023-26281

CVE-2023-26281 affects IBM HTTP Server 8.5 (used with IBM WebSphere Application Server). A remote attacker can trigger a denial-of-service by sending a specially crafted URL. The issue is addressed by IBM HTTP Server fixes; advisories reference an update path for IBM HTTP Server (e.g., 8.5.5.24) ...

CVE-2023-22860

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

CVE-2023-22860 IBM Cloud Pak for Business Automation cross-site scripting

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

CVE-2023-22860

IBM Cloud Pak for Business Automation is affected by CVE-2023-22860, a stored cross-site scripting vulnerability that allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The issue affects multiple releases, including 18.0.x ...

CVE-2022-40237

IBM MQ for HPE NonStop 8.1.0 is affected by a denial-of-service vulnerability (CVE-2022-40237) caused by an error in the CCDT and channel synchronization logic. IBM’s bulletin (APAR IT43171) fixes this issue for the 8.1 line (8.1.0.12) and related 9.x LTS/CD lines with corresponding updates; reme...

CVE-2022-43923

IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local user. IBM X-Force ID: 241584...

CVE-2022-43870

IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticated user in log files. IBM X-Force ID: 239540...

Code injection

IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticated user in log files. IBM X-Force ID: 239540...

Code injection

An authenticated user can exploit a vulnerability in the IBM Spectrum Virtualize 8.2, 8.3, 8.4, and 8.5 GUI to execute code and escalate their privilege on the system. IBM X-Force ID: 239847...

CVE-2022-43578 IBM Sterling B2B Integrator Standard Edition cross-site scripting

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

CVE-2022-43578

CVE-2022-43578 affects IBM Sterling B2B Integrator Standard Edition, specifically versions 6.0.0.0–6.0.3.7 and 6.1.0.0–6.1.2.0. The vulnerability is a cross-site scripting flaw arising from insufficient filtering/escaping of user input in the Web UI, enabling an attacker to embed arbitrary JavaSc...

CVE-2022-43870

IBM Spectrum Virtualize 8.3–8.5 contains a vulnerability where SNMPv3 server credentials can be disclosed to an authenticated user via log files. Root cause: credentials logged in plaintext in system/audit logs accessible to authenticated users. Impact: confidentiality of SNMPv3 credentials could...

CVE-2023-25928

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 247646...

Cross site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 247646...

CVE-2023-25928

IBM InfoSphere Information Server 11.7 is affected by a cross-site scripting (XSS) vulnerability in the Web UI (CVE-2023-25928). The Red Hat advisory summarizes the issue as an XSS in the Web UI that could allow embedding arbitrary JavaScript, potentially leading to credentials disclosure within ...

CVE-2022-43579

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...