Information disclosure

IBM Guardium Data Encryption GDE 5.0.0.2 and 5.0.0.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

CVE-2021-39026

IBM Guardium Data Encryption GDE 5.0.0.2 and 5.0.0.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

CVE-2021-38935

IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 210892...

CVE-2021-38935

IBM Maximo Asset Management core product (7.6.1.2 and 7.6.1.1) is vulnerable due to default weak password requirements, enabling easier account compromise. Root cause: absence of strong password enforcement by default. Impact: attacker access to user accounts. Remediation: apply the appropriate F...

CVE-2021-39034

IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. IBM X-Force ID: 213964...

CVE-2021-39034

IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. IBM X-Force ID: 213964...

CVE-2021-39034

IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. IBM X-Force ID: 213964...

CVE-2021-39034

CVE-2021-39034 (IBM MQ 9.1 LTS) is a denial-of-service vulnerability caused by an issue in the channel process. Public sources (IBM X-Force 213964) cite a base score of 5.3 (CVSS v3.0: AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Affected product: IBM MQ 9.1 LTS. Remediation per IBM bulletin IT37896 ind...

CVE-2021-38935

IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 210892...

CVE-2019-4351

IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. IBM X-Force ID: 161493...

CVE-2019-4352

IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494...

Design/Logic Flaw

IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. IBM X-Force ID: 161493...

Code injection

IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494...

CVE-2019-4352

IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494...

CVE-2019-4352

CVE-2019-4352 affects IBM Maximo Anywhere 7.6.4.0, where the product’s source code could be deobfuscated due to lack of binary obfuscation. The vulnerability’s CVSS details indicate a low-severity impact (C:L, I:N, A:N) with a physical attack vector and no authentication required. IBM’s bulletin ...

CVE-2019-4351

CVE-2019-4351 affects IBM Maximo Anywhere 7.6.4.0, where the application could disclose sensitive information to a user with physical access due to how usernames are stored in local storage (directory names for user attachments). The issue is a local-access information disclosure vulnerability (n...

CVE-2019-4291

CVE-2019-4291 affects IBM Maximo Anywhere 7.6.4.0, where lack of binary protection allows reverse engineering of the application due to missing binary obfuscation. Public sources from NVD/IBM/X-Force corroborate a medium-severity issue (CVSS v3.1 base score 6.5; v2 base 6.4) with network access a...

Security Bulletin: Information disclosure vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-38900

Summary IBM Business Process Manager and IBM Business Automation Workflow are vulnerable to a information disclosure attack, potentially revealing sensitive information to an administrator. Vulnerability Details CVEID: CVE-2021-38900 DESCRIPTION: IBM Business Process Manager 8.5 and 8.6 and IBM...

CVE-2021-39079

IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2021-39080

Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used. IBM X-Force ID: 215593...