CVE-2020-4553

IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force I...

CVE-2020-4553

CVE-2020-4553 affects IBM i2 Analyst’s Notebook 9.2.1 and 9.2.2. The issue is a memory corruption in the product that could allow a local attacker to execute arbitrary code by convincing a user to open a specially crafted file. The IBM advisory notes that fixes were applied in the latest update p...

CVE-2020-4549

IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183317...

CVE-2020-4550

IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force I...

CVE-2020-4549

CVE-2020-4549 affects IBM i2 Analyst’s Notebook 9.2.1 (and IBM i2 Analyst’s Notebook Premium 9.2.1). The vulnerability is caused by memory corruption, allowing a local attacker to execute arbitrary code by convincing a user to open a specially crafted file. IBM’s bulletin notes the fix was applie...

CVE-2020-4550

IBM i2 Analyst’s Notebook 9.2.1 and 9.2.2 are affected by a memory corruption vulnerability that could allow a local attacker to execute arbitrary code by convincing a user to open a specially-crafted file. The issue is documented in IBM’s security bulletin and tied to CVE-2020-4550. Root cause: ...

CVE-2020-4328

IBM Financial Transaction Manager 3.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 177839...

CVE-2020-4377

CVE-2020-4377 affects IBM Cognos Analytics 11.0 and 11.1, where XML data processing is vulnerable to an XML External Entity (XXE) injection. The root cause is improper handling of XML entities, enabling a remote attacker to disclose sensitive information or exhaust memory. According to IBM/NVD en...

CVE-2019-4589

IBM Cognos Analytics 11.0 and 11.1 are affected by a privilege-escalation flaw that allows a less-privileged user to view the r My schedules and subscriptions page. Affected versions: 11.0 (prior to 11.0.13 FP2) and 11.1. Remediation: apply fixes in IBM Cognos Analytics 11.0.13 FP2 or later, an...

CVE-2019-4366

IBM Cognos Analytics 11.0 and 11.1 is susceptible to an information disclosure vulnerability where an attacker could gain access to cached browser data. IBM X-Force ID: 161748...

CVE-2019-4589

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and accessible to a less privileged user. IBM X-Force ID: 167449...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server for IBM Cloud Private VM Quickstarter

Summary There are multiple vulnerabiltities in WebSphere Application Server Liberty that is shipped with IBM WebSphere Application for IBM Cloud Private VM Quickstarter. Information disclosure in WebSphere Application Server. There is a denial of service vulnerablility in WebSphere Application...

CVE-2020-4186

IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-Force ID: 174804...

CVE-2020-4185

IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174803...

Code injection

IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174803...

Code injection

IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-Force ID: 174804...

CVE-2020-4186

IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-Force ID: 174804...

CVE-2020-4186

CVE-2020-4186 affects IBM Security Guardium 10.5, 10.6, 11.0, and 11.1. A vulnerability in the login page could disclose sensitive information, potentially aiding further attacks. IBM’s bulletin frames this as an information exposure in HTML comments, with a CVSS v3 base score of 5.3 (Network, Lo...

CVE-2020-4185

IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174803...

CVE-2020-4463

IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484...