Improper access control

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

Cross site request forgery (csrf)

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 197790...

Buffer overflow

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to there being an observable discrepancy in returned messages. IBM X-Force ID: 195568...

Design/Logic Flaw

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another user's service due to insufficient permission checking. IBM X-Force ID: 195518...

CVE-2021-29700

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authneticated attacker to obtain sensitive information from configuration files that could aid in further attacks against the system. IBM X-Force ID: 200656...

CVE-2021-20584

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 199397...

CVE-2021-20571

The CVE-2021-20571 entry affects IBM Sterling B2B Integrator 5.2.0.0–6.1.1.0 and describes a stored cross-site scripting vulnerability in the Web UI that can embed arbitrary JavaScript to alter functionality and potentially disclose session credentials. Remediation guidance from IBM lists fixed v...

CVE-2021-20571

IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2021-20561

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...

CVE-2021-20552

IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 199170...

CVE-2021-20489

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 197790...

CVE-2021-20489

IBM Sterling File Gateway is affected by CVE-2021-20489 where the web UI is vulnerable to cross-site request forgery, allowing an attacker to perform actions on behalf of a trusted user. Affected versions are 2.2.0.0–5.2.6.5_3, 6.0.0.0–6.0.0.6, 6.0.1.0–6.0.3.4, and 6.1.0.0–6.1.0.3. Remediation: u...

CVE-2021-20481

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID...

CVE-2021-20473

IBM Sterling File Gateway UI versions 2.2.0.0–6.1.1.0 are vulnerable because the product does not invalidate sessions after logout, enabling an authenticated user to impersonate another user. The issue is addressed in IBM’s security bulletin with remediation guidance: upgrade to fixed releases (5...

CVE-2021-20376

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to there being an observable discrepancy in returned messages. IBM X-Force ID: 195568...

CVE-2021-29908

The IBM TS7700 Management Interface is vulnerable to unauthenticated access. By accessing a specially-crafted URL, an attacker may gain administrative access to the Management Interface without authentication. IBM X-Force ID: 207747...

CVE-2021-38923

IBM PowerVM Hypervisor FW1010 could allow a privileged user to gain access to another VM due to assigning duplicate WWPNs. IBM X-Force ID: 210162...

CVE-2021-38923

IBM PowerVM Hypervisor FW1010 could allow a privileged user to gain access to another VM due to assigning duplicate WWPNs. IBM X-Force ID: 210162...

Authentication flaw

The IBM TS7700 Management Interface is vulnerable to unauthenticated access. By accessing a specially-crafted URL, an attacker may gain administrative access to the Management Interface without authentication. IBM X-Force ID: 207747...

CVE-2021-38923

CVE-2021-38923 affects IBM PowerVM Hypervisor FW1010. The vulnerability arises from assigning duplicate WWPNs to virtual fiber channel adapters in peer VMs, which could allow a privileged user to gain access to another VM. Affected product: PowerVM Hypervisor FW1010 (Power 10 lineage). The IBM Se...