12960 matches found
CVE-2019-4184
IBM Jazz Reporting Service 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...
CVE-2019-4184
The CVE-2019-4184 entry affects IBM Jazz Reporting Service (JRS) versions 6.0–6.0.6.1, where a cross-site scripting (XSS) vulnerability in the Web UI could allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. The NVD/NIST entry shows CVSS v3.0 base s...
CVE-2019-4264
IBM QRadar SIEM 7.2.8 WinCollect could allow an attacker to obtain sensitive information by spoofing a trusted entity using man in the middle techniques due to not validating or incorrectly validating a certificate. IBM X-Force ID: 160072...
CVE-2019-4138
IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middl...
CVE-2019-4139
IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...
CVE-2019-4256
IBM API Connect is affected by CVE-2019-4256 for versions 5.0.0.0 through 5.0.8.6, where weaker cryptographic algorithms could allow decryption of highly sensitive information. The issue specifically affects the cryptographic implementation in API Connect. The recommended remediation is to upgrad...
CVE-2019-4137
IBM Spectrum Control (formerly Tivoli Storage Productivity Center) is affected by CVE-2019-4137. Versions 5.2.13–5.2.17.2 and 5.3.0–5.3.2 are vulnerable to cross-site scripting in the Web UI, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted ...
CVE-2019-4138
IBM Spectrum Control (formerly Tivoli Storage Productivity Center) is affected by CVE-2019-4138. Versions 5.2.13–5.2.17.2 and 5.3.0–5.3.2 are vulnerable to information disclosure due to failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive infor...
CVE-2019-4256
IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 159944...
CVE-2019-4078
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on MQ installation directories. IBM X-Force ID: 157190...
CVE-2019-4039
CVE-2019-4039 affects IBM WebSphere MQ: 8.0.0.0–8.0.0.9 and 9.0.0.0–9.1.1. The issue allows a local attacker to cause a denial of service within the error log reporting system. Root cause is tied to the error logging function; no exploit details are provided in the documents. The vulnerability is...
CVE-2019-4039
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local attacker to cause a denial of service within the error log reporting system. IBM X-Force ID: 156163...
CVE-2019-4078
CVE-2019-4078 affects IBM WebSphere MQ installations on Windows where incorrect permissions on MQ installation directories permit a local non-privileged user to execute code with administrator privileges. Affected MQ versions include 8.0.0.0–8.0.0.9 and 9.0.0.0–9.1.1. IBM remediation/fixes are av...
CVE-2019-4078
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on MQ installation directories. IBM X-Force ID: 157190...
CVE-2018-1991
IBM API Connect 5.0.0.0–5.0.8.6 is affected by an information-disclosure vulnerability (CVE-2018-1991) that could reveal sensitive information about the underlying software stack via CMC UI headers. The root cause is a disclosure in requests/responses that exposes internal details. Affected produ...
CVE-2018-1991
IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers. IBM X-Force ID: 154284...
CVE-2018-2005
IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions. IBM X-Force ID: 155007...
CVE-2019-4011
IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155885...
Information disclosure
IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions. IBM X-Force ID: 155007...
Cross site scripting
IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155885...