CVE-2020-4262

IBM i2 Analyst’s Notebook and IBM i2 Analyst’s Notebook Premium (9.2.1) are affected by CVE-2020-4262 due to memory corruption during loading of .anb files. A local attacker could exploit a specially crafted file to execute arbitrary code on the system. The IBM Security Bulletin confirms multiple...

CVE-2020-4261

IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force...

CVE-2020-4259

CVE-2020-4259 affects IBM Sterling File Gateway. The issue allows an authenticated user to manipulate cookie information and add/remove modules in the cookie, enabling access to functionality not authorized. Affected versions are 2.2.0.0–2.2.6.5_1 and 6.0.0.0–6.0.3.1. IBM assigns a CVSS v3.0/3.1 ...

CVE-2020-4258

IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force...

CVE-2020-4259

IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information and remove or add modules from the cookie to access functionality not authorized to. IBM X-Force ID: 175638...

CVE-2020-4257

IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force...

Information disclosure

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensitive information from a cached web page. IBM X-Force ID: 177089...

CVE-2020-4312

CVE-2020-4312 affects IBM Sterling B2B Integrator Standard Edition, versions 5.2.0.0–5.2.6.5_1 and 6.0.0.0–6.0.3.1. The vulnerability enables an authenticated user to obtain sensitive information from a cached web page (information disclosure). The issue is addressed by upgrading to IBM Sterling ...

CVE-2020-4346

IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322...

CVE-2019-4478

IBM Maximo Asset Management 7.6.0, and 7.6.1 could allow an authenticated user to obtain highly sensitive information that they should not normally have access to. IBM X-Force ID: 163998...

CVE-2020-4195

IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

Code injection

IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322...

Design/Logic Flaw

IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

CVE-2020-4346

CVE-2020-4346 affects IBM API Connect: management server with versions 2018.4.1.0–2018.4.1.10 contains an unsecured API that allows an unauthenticated attacker to obtain sensitive information. The issue is documented by IBM and is associated with a CVSS ~5.3 (medium) overall impact, reflecting in...

CVE-2020-4195

CVE-2020-4195 affects IBM API Connect: API Connect V2018.4.1.0–2018.4.1.10 vulnerable to clickjacking via a malicious website, enabling a remote actor to hijack the user’s click actions. The IBM security bulletin confirms remediation in V2018.4.1.11 (addressed) and provides the upgrade path (2018...

CVE-2019-4478

IBM Maximo Asset Management has a CVE-2019-4478 information-disclosure vulnerability affecting core product versions 7.6.0 and 7.6.1 (and 7.6.1.1 per IBM bulletin). An authenticated user could obtain highly sensitive information they should not access. CVSS vectors listed include High confidentia...

CVE-2019-4667

IBM UrbanCode Deploy UCD 7.0.5.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID:...

Information disclosure

IBM UrbanCode Deploy UCD 7.0.5.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID:...

CVE-2019-4667

IBM UrbanCode Deploy UCD 7.0.5.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID:...

CVE-2019-4667

CVE-2019-4667 affects IBM UrbanCode Deploy (UCD). The IBM security bulletin and NVD entries indicate that UCD versions affected include 7.0.5.2 and earlier, with the root cause being failure to properly enable HTTP Strict Transport Security (HSTS). This omission can allow a remote attacker to obt...