CVE-2019-4011

CVE-2019-4011 affects IBM BigFix Platform 9.2 and 9.5, where a cross-site scripting flaw in the Web UI can allow embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Root cause: XSS in the Web UI. Impact is described as credential exposure; no ex...

CVE-2019-4058

CVE-2019-4058 affects IBM BigFix Platform versions 9.2 through 9.5, where a low-privilege user can manipulate the UI to expose interface elements and information normally restricted to administrators. The issue is confirmed across multiple sources (NVD, vendor PT/security pages), with the impact ...

CVE-2019-4011

IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155885...

CVE-2019-4293

IBM Storwize V7000 Unified 2073 1.6 configuration may allow an attacker to reveal the server version in default installation, which could be used in further attacks against the system. IBM X-Force ID: 160699...

CVE-2019-4293

CVE-2019-4293 affects IBM Storwize V7000 Unified. Affected releases: V7000 Unified 1.6.x (1.6.0.0–1.6.2.5) may reveal the server/Apache Tomcat version in default installations. Root cause: exposure of server version information could aid further attacks. Remediation: upgrade to 1.6.2.6 or later (...

CVE-2019-4058

IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements and information normally restricted to administrators. IBM X-Force ID: 156570...

CVE-2018-2005

CVE-2018-2005 affects IBM BigFix Platform versions 9.2 and 9.5. The vulnerability is an information disclosure where potentially sensitive data is stored in process memory and could be read by a local attacker with elevated permissions. The issue stems from data stored in memory and is categorize...

CVE-2018-2005

IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions. IBM X-Force ID: 155007...

CVE-2019-4279

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445...

Code injection

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445...

CVE-2019-4119

IBM Cloud Private Kubernetes API server versions 2.1.x and 3.1.x (3.1.0, 3.1.1, 3.1.2) can be used as an HTTP proxy to reach internal and external target IPs. The root cause is an input/proxy handling issue that allows proxying beyond intended scope. Remediation per IBM’s bulletin: upgrade to IBM...

CVE-2019-4119

IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1, and 3.1.2 can be used as an HTTP proxy to not only cluster internal but also external target IP addresses. IBM X-Force ID: 158145...

Cross site scripting

IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2018-1975

CVE-2018-1975 affects IBM Rational DOORS Web Access. Affected versions include 9.5.1–9.5.2.9 and 9.6–9.6.1.9, where the web UI is vulnerable to cross-site scripting, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. Root cause descri...

CVE-2018-1975

IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2019-4259

A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensitive data to be included with service snaps. IBM X-Force ID: 160011...

CVE-2019-4259

A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensitive data to be included with service snaps. IBM X-Force ID: 160011...

Security feature bypass

A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensitive data to be included with service snaps. IBM X-Force ID: 160011...

CVE-2019-4259

CVE-2019-4259 affects IBM Spectrum Scale with CES stack enabled (versions 4.1.1–5.0.0). Affected component: CES stack, where sensitive data could be included with service snaps. The IBM bulletin identifies affected releases and provides fixes: upgrade to V4.1.1.23 (for 4.1.1 branch), V4.2.3.14 (f...

CVE-2019-4204

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...