12960 matches found
CVE-2022-22399 IBM Aspera Faspex HTTP header injection
IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM...
CVE-2022-22399 IBM Aspera Faspex HTTP header injection
IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM...
CVE-2023-25681 IBM Spectrum Virtualize security bypass
LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. This does not affect local users with MFA configured or remote users authenticating via single sign-on. IBM X-Force ID...
CVE-2023-25681 IBM Spectrum Virtualize security bypass
LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. This does not affect local users with MFA configured or remote users authenticating via single sign-on. IBM X-Force ID...
CVE-2023-25681
IBM Spectrum Virtualize 8.5 (CVE-2023-25681) permits LDAP-authenticated users configured for MFA to access the CIM interface using only a username and password, bypassing MFA. The issue affects CIM authentication and does not apply to local MFA users or SSO-enabled remote users. Red Hat and CVE l...
CVE-2023-26282 IBM Watson CP4D Data Stores file modificiation
IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the system. IBM X-Force ID: 248415...
CVE-2023-26282
CVE-2023-26282 affects IBM Watson CP4D Data Stores versions 4.6.0–4.6.3. The root cause is a security flaw that could allow a user with physical access and system-specific knowledge to modify files or data on the system. Impact, as described in sources, is the possibility to modify files/data wit...
CVE-2023-35899 IBM Cloud Pak for Automation CSV injection
IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file...
CVE-2024-22352 IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 280361...
IBM WebSphere Application Server Liberty 17.0.0.3 < 24.0.0.3 (7125527)
The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a vulnerability as referenced in the 7125527 advisory. - IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections...
Buffer overflow
IBM Connect:Express for UNIX 1.5.0 is vulnerable to a buffer overflow that could allow a remote attacker to cause a denial of service through its browser UI. IBM X-Force ID: 254979...
CVE-2023-32331 IBM Connect:Express for UNIX denial of service
IBM Connect:Express for UNIX 1.5.0 is vulnerable to a buffer overflow that could allow a remote attacker to cause a denial of service through its browser UI. IBM X-Force ID: 254979...
CVE-2023-32331
CVE-2023-32331 – IBM Sterling Connect:Express for UNIX (1.5.0) is affected by a buffer overflow in the browser UI that can allow a remote attacker to cause a denial of service. The vulnerability originates from improper validation of input data. Remediation provided by IBM recommends upgrading to...
CVE-2023-38360
IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260769...
Cross site scripting
IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260769...
CVE-2023-38360 IBM CICS TX cross-site scripting
IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260769...
CVE-2023-38360
IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting due to insufficient filtering/escaping of user-supplied data in the Web UI. This can allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Remediation/fix is availabl...
CVE-2023-38362
IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814...
CVE-2022-43890
IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 240453...