CVE-2022-22442

"IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users with elevated privileges due to improper access controls. IBM X-Force ID: 224427."...

CVE-2022-35717

"IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-"Force ID: 231361...

CVE-2022-42442

CVE-2022-42442 affects IBM Robotic Process Automation for Cloud Pak, versions

CVE-2022-35279

CVE-2022-35279 affects IBM Business Automation Workflow (containers and traditional deployments). The issue is an information-disclosure vulnerability where authenticated users could learn sensitive version information, which could facilitate further attacks. Affected products/versions include IB...

CVE-2022-35279

"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could be used in further attacks against the system. IBM X-Force ID: 230537."...

CVE-2022-38712

"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."...

CVE-2022-43574

"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to application configurations. IBM X-Force ID: 238679."...

CVE-2022-35642

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592."...

CVE-2022-30615

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592...

CVE-2022-42442 IBM Robotic Process Automation for Cloud Pak information disclosure

IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. IBM X-Force ID: 238214...

CVE-2022-30615

IBM InfoSphere Information Server 11.7 is affected by a cross-site scripting (XSS) vulnerability in the Web UI. The issue allows an attacker to inject arbitrary JavaScript and potentially disclose credentials within a trusted session. Remediation per IBM Security Bulletin: apply updates to versio...

CVE-2022-38712

"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."...

CVE-2022-40230

"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235532."...

CVE-2022-43574

"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to application configurations. IBM X-Force ID: 238679."...

CVE-2022-38710 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292...

CVE-2022-38710 IBM Robotic Process Automation information disclosure

IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attacks against the system. IBM X-Force ID: 234292...

CVE-2022-40235

CVE-2022-40235 affects IBM InfoSphere Information Server 11.7. The vulnerability stems from improper input validation and can cause a denial of service by removing the ability to run jobs. According to IBM’s bulletin, affected product is InfoSphere Information Server 11.7 and remediation is to up...

CVE-2022-22425

IBM InfoSphere Information Server 11.7 is identified as potentially vulnerable to CSV Injection due to improper validation of CSV file contents. The vulnerability could allow a remote attacker to execute arbitrary commands on the system; CVSS metrics in public records indicate a high impact (C, I...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to WebSphere Application Server Liberty identity spoofing (CVE-2022-24476)

Summary Potential vulnerabilities in WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty identity spoofing by an authenticated user using a specially crafted requestCVE-2022-24476 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refe...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to multiple vulnerabilities due to Eclipse Jetty

Summary IBM Sterling Connect:Direct Web Services uses Eclipse Jetty. Multiple Eclipse Jetty vulnerabilities have been addressed. Vulnerability Details IBM X-Force ID: 230016 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an error related to some of the production serve...