CVE-2022-22465

IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 could allow a local user to obtain elevated privileges due to improper access permissions. IBM X-Force ID: 225082...

CVE-2022-22465

CVE-2022-22465 affects IBM Security Access Manager Appliance (ISAM) / IBM Security Verify Access Appliance versions 10.0.0.0–10.0.3.0. The issue is improper access permissions that could allow a local user to obtain elevated privileges. IBM’s bulletin confirms the vulnerability and provides a fix...

CVE-2022-22464

The CVE-2022-22464 entry concerns IBM Security Access Manager Appliance. Affected products are IBM Security Access Manager Appliance versions 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0. The issue is described as using weaker-than-expected cryptographic algorithms that could allow an attacker to d...

CVE-2022-22464

IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225081...

CVE-2022-22463

Summary: IBM Security Access Manager Appliance (ISAM Appliance) versions 10.0.0.0–10.0.3.0 are vulnerable to SQL injection. A remote attacker could send crafted SQL to view, add, modify, or delete data in the back‑end database. Mitigation: IBM recommends upgrading to IBM Security Verify Access Ap...

CVE-2022-22370

IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2022-22370

CVE-2022-22370 affects IBM Security Verify Access 10.0.0.0–10.0.3.0, with cross-site scripting via the Web UI due to inadequate cleaning of user-provided data. Documented impact: arbitrary JavaScript in the UI potentially leading to credentials disclosure within a trusted session. Remediation app...

CVE-2022-34167

IBM CICS TX Standard and Advanced 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2022-34160

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 229330...

CVE-2022-34306

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. I...

Cross site scripting

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. I...

Cross site scripting

IBM CICS TX Standard and Advanced 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

Cross site scripting

IBM CICS TX Standard and Advanced 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229430...

CVE-2022-34306

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. I...

CVE-2022-34306

IBM CICS TX Standard and Advanced (11.1) are affected by CVE-2022-34306 due to HTTP header injection caused by improper validation of HOST headers. This can enable cross-site scripting, cache poisoning, or session hijacking as described by IBM security bulletins. Remediation is to apply the inter...

CVE-2022-34167

CVE-2022-34167 affects IBM CICS TX Standard and IBM CICS TX Advanced (11.1). The vulnerability is a stored cross-site scripting flaw in the Web UI that allows embedding arbitrary JavaScript, potentially enabling credentials disclosure within a trusted session. Root cause: insufficient input valid...

CVE-2022-34166

IBM CICS TX Standard and Advanced 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229430...

CVE-2022-34166

CVE-2022-34166 affects IBM CICS TX Standard and IBM CICS TX Advanced (11.1). The issue is a cross-site scripting vulnerability allowing embedded arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. IBM's advisories state the vulnerability is ...

CVE-2022-34160

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 229330...

Security Bulletin: A security vulnerability has been identified in jackson-databind shipped with IBM Tivoli Netcool Impact (CVE-2020-36518, WS-2021-0616)

Summary jackson-databind is shipped with IBM Tivoli Netcool Impact. Information about a security vulnerability affecting jackson-databind has been published in a security bulletin. Vulnerability Details CVEID:CVE-2020-36518 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of...