12960 matches found
Code injection
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to perform unauthorized actions using a specially crated HTTP POST command. IBM X-Force ID: 179157...
Code injection
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179158...
Information disclosure
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178761...
Code injection
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178423...
Cross site scripting
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 17876...
Code injection
IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing function level access control. IBM X-Force ID: 178414...
CVE-2020-4379
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179158...
CVE-2020-4358
CVE-2020-4358 affects IBM Spectrum Scale 5.0.0.0 through 5.0.4.4, where the Web UI is vulnerable to cross-site scripting, enabling injection of arbitrary JavaScript that can lead to credentials disclosure within a trusted session. IBM Security Bulletins for Spectrum Scale GUI and ESS cite a fix: ...
CVE-2020-4378
CVE-2020-4378 affects IBM Spectrum Scale GUI (and ESS) with versions 5.0.0.0–5.0.4.4 (and ESS 3000 GUI variants). The issue allows a privileged, authenticated user to perform unauthorized actions via a specially crafted HTTP POST command. Root cause details are not explicitly broken out in the pr...
CVE-2020-4350
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178424...
CVE-2020-4357
IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178761...
CVE-2020-4350
CVE-2020-4350 affects IBM Spectrum Scale (and related IBM ESS/GUIs) versions 5.0.0.0 through 5.0.4.4, where weaker cryptographic algorithms could allow decryption of highly sensitive data. Connected IBM advisories specify the affected products and versions, with remediations: IBM Spectrum Scale G...
CVE-2020-4357
Summary of CVE-2020-4357 details (from connected IBM/Spectrum Scale sources): IBM Spectrum Scale and the IBM Spectrum Scale GUI are affected by verbose/error disclosure where detailed technical error messages returned in the browser can reveal sensitive information. Affected products/versions inc...
CVE-2020-4348
CVE-2020-4348 affects IBM Spectrum Scale GUI components: versions 4.2.0.0–4.2.3.21 and 5.0.0.0–5.0.4.4 allow an authenticated GUI user to perform unauthorized actions due to missing function-level access control. Documents from IBM Security Bulletins identify affected products and fixes: Spectrum...
CVE-2020-4349
CVE-2020-4349 : IBM Spectrum Scale (GPFS) 5.0.0.0–5.0.4.4 uses weaker cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM references the vulnerability in multiple advisories for ESS/Spectrum Scale GUI and ESS 3000, with affected products including IB...
CVE-2020-4226
IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 175207...
CVE-2020-4226
IBM MobileFirst Platform Foundation 8.0.0.0 is affected by CVE-2020-4226 due to storing highly sensitive information in URL parameters, enabling potential information disclosure if URLs are exposed via server logs, referrer headers, or browser history. Root cause: sensitive data appended to URLs ...
Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2019-4720)
Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to a security vulnerability. IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service and a remote attacker could exploit this vulnerability to cause the...
Security Bulletin: Vulnerabilities in WebSphere liberty related to DOS
Summary There are vulnerabilities in WebSphere liberty related to DOS used by IBM Streams. IBM Streams has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-4720 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by...
