CVE-2020-4672

IBM Business Automation Workflow version 20.0.0.1 is vulnerable to cross-site scripting in the Web UI, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. The IBM Security Bulletin identifies the affected version and recommends applyin...

CVE-2020-4692

CVE-2020-4692 affects IBM Sterling B2B Integrator Standard Edition: 6.0.0.0–6.0.3.2 and 5.2.0.0–5.2.6.5. It is a path traversal vulnerability that could allow an authenticated user to obtain sensitive information from the Dashboard UI. Remediation: upgrade to 5.2.6.5_3, 6.0.3.3, or 6.1.0.0 (per I...

CVE-2020-4692

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user to obtain sensitive information from the Dashboard UI. IBM X-Force ID: 186780...

CVE-2020-4665

CVE-2020-4665 affects IBM Sterling File Gateway versions 2.2.0.0–2.2.6.5 and 6.0.0.0–6.0.3.2. Root cause: the product does not set the secure attribute on authorization tokens or session cookies, enabling cookie values to be exposed when a user clicks an http:// link or visits an attacker-control...

CVE-2020-4671

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 stores potentially sensitive information in log files that could be read by an authenticatedl user. IBM X-Force ID: 186284...

CVE-2020-4671

CVE-2020-4671 affects IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0–6.0.3.2 and 5.2.0.0–5.2.6.5. The issue is an information disclosure where potentially sensitive data can be read from log files by an authenticated user. IBM’s Security Bulletin details the affected versions and p...

CVE-2020-4655

The CVE affects IBM Sterling B2B Integrator Standard Edition, specifically versions 6.0.0.0–6.0.3.2 and 5.2.0.0–5.2.6.5. The underlying issue is SQL injection that could let a remote attacker view, add, modify, or delete data in the back-end database. IBM’s security bulletin lists remediation by ...

CVE-2020-4566

IBM Sterling B2B Integrator External/Backend B2B API logs may expose highly sensitive information to authenticated users. Affects Standard Edition 5.2.6.0–5.2.6.5 and 6.0.0.0–6.0.3.2. Root cause is information disclosure via log files; remediation: upgrade to 5.2.6.5_3, 6.0.3.3, or 6.1.0.0 (per I...

CVE-2020-4566

IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 stores potentially highly sensitive information in log files that could be read by an authenticated user. IBM X-Force ID: 184083...

CVE-2020-4476

IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID:...

CVE-2020-4886

IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910...

CVE-2020-4886

Summary: IBM InfoSphere Information Server 11.7 contains an information disclosure vulnerability where sensitive data could be exposed via the browser history when a user with access to the same system is present. Affected product/version: InfoSphere Information Server (and Cloud) 11.7. Root caus...

CVE-2020-4700

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user belonging to a specific user group to create a user or group with administrative privileges. IBM X-Force ID: 187077...

CVE-2020-4705

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

CVE-2020-4692

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user to obtain sensitive information from the Dashboard UI. IBM X-Force ID: 186780...

Code injection

A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos...

CVE-2020-4685

A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos...

CVE-2020-4685

IBM Cognos Controller is affected by CVE-2020-4685. A low-level user with server admin rights on IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, or 10.4.2 can escalate to Super Admin and create/update/delete any user. The IBM Security Bulletin cites a base CVSS v3 score of 8.0 (HIGH) with n...

CVE-2020-4704

IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187189...

CVE-2020-4760

IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188737...