CVE-2023-47707

CVE-2023-47707 affects IBM Security Guardium Key Lifecycle Manager (GKLM) 4.3. It is a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. The primary affected product i...

CVE-2023-47707 IBM Security Guardium Key Lifecycle Manager cross-site scripting

IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2023-47703 IBM Security Guardium Key Lifecycle Manager information disclosure

IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 271197...

CVE-2023-47703 IBM Security Guardium Key Lifecycle Manager information disclosure

IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 271197...

CVE-2023-47703

IBM Security Guardium Key Lifecycle Manager 4.3 is affected by CVE-2023-47703, which, per the sources, could allow a remote attacker to obtain sensitive information via a detailed technical browser error message. The issue relates to information disclosure (C/L with low confidentiality impact) an...

CVE-2023-47704

IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220...

CVE-2023-47706

IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341...

Hardcoded credentials

IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220...

CVE-2023-47702

CVE-2023-47702 affects IBM Security Guardium Key Lifecycle Manager. The connected documents specify a path traversal vulnerability where a remote attacker could craft URL requests containing dot-dot sequences (/../) to traverse directories and view/modify files on the system. The issue is tied to...

CVE-2023-47702 IBM Security Guardium Key Lifecycle Manager directory traversal

IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view modify files on the system. IBM X-Force ID: 271196...

CVE-2023-47706 IBM Security Guardium Key Lifecycle Manager file upload

IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341...

CVE-2023-47705

IBM Security Guardium Key Lifecycle Manager 4.3 includes a vulnerability where an authenticated user could manipulate username data due to improper input validation (CVE-2023-47705). The IBM security bulletin (and cross-referenced records) confirms this CVE and notes the issue exists in GKLM and ...

CVE-2023-47704 IBM Security Guardium Key Lifecycle Manager information disclosure

IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220...

CVE-2023-47704

CVE-2023-47704 affects IBM Security Guardium Key Lifecycle Manager, version 4.3. The issue is the presence of plain text hard-coded credentials or other secrets in the source code repository, causing potential confidentiality impact. Exploitation details are not provided in the connected document...

CVE-2023-42012

An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts. IBM X-Force ID: 265509...

CVE-2023-42013

IBM UrbanCode Deploy UCD 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM...

Information disclosure

IBM UrbanCode Deploy UCD 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM...

Input validation

IBM UrbanCode Deploy UCD 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion. IBM X-Force ID: 270799...

CVE-2023-47161

IBM UrbanCode Deploy (UCD) is affected by CVE-2023-47161 due to mishandling input validation of an uploaded archive file, causing a denial of service from resource exhaustion. Affected versions are 7.0–7.0.5.18, 7.1–7.1.2.14, 7.2–7.2.3.7, and 7.3–7.3.2.2. Remediation guidance recommends upgrading...

CVE-2023-47161 IBM UrbanCode Deploy denial of service

IBM UrbanCode Deploy UCD 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion. IBM X-Force ID: 270799...