Design/Logic Flaw

IBM MQ 8.0, 9.0, 9.1, 9.2, and 9.3 could disclose sensitive user information from a trace file if that functionality has been enabled. IBM X-Force ID: 251358...

Cross site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2022-47984 IBM InfoSphere Information Server SQL injection

IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 243163...

CVE-2022-47984

CVE-2022-47984 affects IBM InfoSphere Information Server 11.7. The issue is a SQL injection vulnerability stemming from insufficient validation of externally supplied SQL statements, allowing a remote attacker to view, add, modify, or delete data in the backend database. Remediation per IBM bulle...

CVE-2023-22878 IBM InfoSphere Information Server information disclosure

IBM InfoSphere Information Server 11.7 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 244373...

CVE-2023-22878

CVE-2023-22878 affects IBM InfoSphere Information Server 11.7, where user credentials are stored in plaintext readable by a local user. Root cause: insecure storage of sensitive information. Impact: potential information disclosure to local attackers. Remediation: apply IBM fixes for 11.7, specif...

CVE-2023-28529

IBM InfoSphere Information Server 11.7 is vulnerable to a stored cross-site scripting (XSS) flaw (CVE-2023-28529). The issue allows an attacker to inject arbitrary JavaScript into the Web UI, potentially leading to credentials disclosure within a trusted session. IBM has addressed this vulnerabil...

CVE-2023-28950 IBM MQ information disclosure

IBM MQ 8.0, 9.0, 9.1, 9.2, and 9.3 could disclose sensitive user information from a trace file if that functionality has been enabled. IBM X-Force ID: 251358...

CVE-2023-28950

CVE-2023-28950 affects IBM MQ 8.0, 9.0, 9.1, 9.2, and 9.3, allowing disclosure of sensitive user information from a trace file when tracing is enabled. The primary public references list IBM MQ-related advisories and remediation paths: IBM Security Bulletin for App Connect Enterprise/Integration ...

CVE-2023-28514

IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace. IBM X-Force ID: 250398...

Design/Logic Flaw

IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace. IBM X-Force ID: 250398...

CVE-2023-28514 IBM MQ information disclosure

IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace. IBM X-Force ID: 250398...

CVE-2023-28514 IBM MQ information disclosure

IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace. IBM X-Force ID: 250398...

Security Bulletin: IBM MQ Appliance is affected by an IBM Java vulnerability (CVE-2023-30441)

Summary IBM MQ Appliance has resolved an IBM Java vulnerability. Vulnerability Details CVEID:CVE-2023-30441 DESCRIPTION: IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and...

CVE-2023-30438

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition to perform an undetected violation of the isolation between logical partitions which could lead to data leakage or the execution of...

CVE-2023-30438 IBM PowerVM gain access

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition to perform an undetected violation of the isolation between logical partitions which could lead to data leakage or the execution of...

CVE-2023-30438

PowerVM in IBM Power9/Power10 systems contains an internally discovered vulnerability that could allow a privileged user in one logical partition to violate isolation and potentially leak data or execute code in other partitions on the same physical server. Affected component is the PowerVM Hyper...

Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details CVEID:CVE-2018-25031 DESCRIPTION: swagger-ui could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a specially-crafted URL, an attacker could exploit this vulnerabili...

Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details CVEID:CVE-2022-24772 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification when checking for tailing garbage byt...

CVE-2023-27863

IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be used to access vSnap data stores. IBM X-Force ID: 249325...