Xxe

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or...

Server side request forgery (ssrf)

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network...

Design/Logic Flaw

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Force ID: 228888...

Cross site scripting

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

Input validation

IBM UrbanCode Deploy UCD 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 through 7.2.3.0 could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. IBM X-Force ID: 231360...

CVE-2022-22505

CVE-2022-22505 affects IBM Robotic Process Automation prior to version 21.0.3 (i.e., 21.0.0–21.0.2). The IBM Security Bulletin documents that this vulnerability could expose IBM tenant credentials. The CVSS scores in public records show a base impact on confidentiality (C:H) with no availability/...

CVE-2022-35716

IBM UrbanCode Deploy UCD 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 through 7.2.3.0 could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. IBM X-Force ID: 231360...

CVE-2022-35716

CVE-2022-35716 affects IBM UrbanCode Deploy (UCD) across multiple lines: 6.2.0.0–6.2.7.16, 7.0.0.0–7.0.5.11, 7.1.0.0–7.1.2.7, and 7.2.0.0–7.2.3.0. The issue stems from improper security checks that can allow an authenticated user to obtain sensitive information in some instances (information disc...

CVE-2022-32750

CVE-2022-32750 affects IBM DataPower Gateway: versions 10.0.2.0–10.0.4.0, 10.0.1.0–10.0.1.8, 10.5.0.0, and 2018.4.1.0–2018.4.1.21 are vulnerable to cross-site scripting through the Web UI, allowing arbitrary JavaScript that could disclose credentials in a trusted session. Remediation: upgrade to ...

CVE-2022-31776

CVE-2022-31776 affects IBM DataPower Gateway: SSRF in 10.0.2.0–10.0.4.0, 10.0.1.0–10.0.1.8, 10.5.0.0, and 2018.4.1.0–2018.4.1.21. The IBM security bulletin states a vulnerability leading to potential unauthorized requests from the system, enabling network enumeration or related impacts. Remediati...

CVE-2022-31776

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network...

CVE-2022-31775

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or...

CVE-2022-31774

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2022-31774

CVE-2022-31774 affects IBM DataPower Gateway. Vulnerable in Web UI where lack of data validation/filtering lets attackers embed arbitrary JavaScript, potentially disclosing credentials in a trusted session. Affected versions include 10.0.1.0–10.0.1.8, 10.0.2.0–10.0.4.0, 10.5.0.0, and 2018.4.1.0–2...

CVE-2022-22326

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856...

CVE-2022-22326

CVE-2022-22326 affects IBM DataPower Gateway and IBM MQ Appliance with insufficient authorization checks allowing unauthorized viewing of logs and files. Affected products and versions include IBM DataPower Gateway 10.0.1.0–10.0.1.5, 10.0.2.0–10.0.4.0, and 2018.4.1.0–2018.4.1.18; remediation upgr...

Design/Logic Flaw

IBM PowerVM VIOS 3.1 could allow a remote attacker to tamper with system configuration or cause a denial of service. IBM X-Force ID: 230956...

CVE-2022-35643

CVE-2022-35643 affects IBM PowerVM VIOS 3.1. Affected filesets include devices.vtdev.scsi.rte (lower/upper levels 7.2.4.0–7.2.4.4, 7.2.5.0–7.2.5.3, 7.2.5.100–7.2.5.102). Root cause and impact: remote tampering of system configuration or DoS. Remediation is via IBM APARs IJ40954/IJ40951/IJ40952 fo...

Security Bulletin: IBM PowerVM Novalink is vulnerable because IBM WebSphere Application Server Liberty, with the adminCenter-1.0 feature configured, could allow an authenticated user to issue a request to obtain the status . (CVE-2022-22393)

Summary IBM PowerVM Novalink is vulnerable because IBM WebSphere Application Server Liberty 1, with the adminCenter-1.0 feature configured, could allow an authenticated user to issue a request to obtain the status of HTTP/HTTPS ports which are accessible by the application server. Vulnerability...

CVE-2021-39088

IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unknown vulnerabilities then privilege escalation could be performed. IBM X-Force ID: 216111...