CVE-2022-34313 IBM CICS TX Standard is vulnerable to allowing attackers access to an application via insecure session cookies

IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can...

CVE-2022-38387

IBM Cloud Pak for Security CP4S 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 233786...

CVE-2022-31772

IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. IBM X-Force ID: 228335...

CVE-2022-36776

IBM Cloud Pak for Security CP4S 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Code injection

IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. IBM X-Force ID: 228335...

Design/Logic Flaw

IBM Cloud Pak for Security CP4S 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 233786...

Cross site scripting

IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2022-31772

CVE-2022-31772 affects IBM MQ channels (MQTT) on IBM MQ versions 8.0, 9.0 LTS, 9.1 CD/LTS, and 9.2 CD/LTS. Root cause described as a denial of service vulnerable path in channel/messaging processing; authenticated, authorized user can trigger DoS on MQTT channels. Remediation: apply APAR IT33206 ...

CVE-2022-31772 IBM MQ denial of service

IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. IBM X-Force ID: 228335...

CVE-2022-40753 IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236688...

CVE-2022-40753 IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236688...

CVE-2022-40753

The CVE-2022-40753 issue affects IBM InfoSphere Information Server 11.7, where a cross-site scripting vulnerability exists in the Web UI that can allow embedding arbitrary JavaScript and potentially disclose credentials in a trusted session. The root cause is a Web UI XSS in InfoSphere Informatio...

CVE-2022-36776

IBM Cloud Pak for Security (CP4S) versions 1.10.0.0 through 1.10.2.0 are affected by a cross-site scripting (XSS) vulnerability that allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure in a trusted session. Root cause: reflected or stored XSS in the ...

CVE-2022-36776

IBM Cloud Pak for Security CP4S 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2022-40750 IBM WebSphere Application Server cross-site scripting

IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2022-40750

CVE-2022-40750 affects IBM WebSphere Application Server (WAS) 7.0, 8.0, 8.5 and 9.0, with cross-site scripting in the Admin Console (notably via the Application Migration Report function). The vulnerability enables an attacker to inject arbitrary JavaScript into the Web UI, potentially leading to...

CVE-2022-40750 IBM WebSphere Application Server cross-site scripting

IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2022-38387

CVE-2022-38387 affects IBM Cloud Pak for Security (CP4S) versions 1.10.0.0 through 1.10.2.0. Affected component: CP4S service logic exposed to remote requests. Root cause: command injection allowing a remote authenticated attacker to execute arbitrary commands on the system via a specially crafte...

CVE-2022-34331

After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly configured leading to desired VEPA configuration being disabled. IBM X-Force ID: 229695...

Design/Logic Flaw

After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly configured leading to desired VEPA configuration being disabled. IBM X-Force ID: 229695...