CVE-2021-20346

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194595...

CVE-2020-4732

IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-Force ID: 188126...

CVE-2020-4561

CVE-2020-4561 affects IBM Cognos Analytics 11.0 and 11.1, specifically the DQM API, which allows submitting of all control requests in unauthenticated sessions. This can let a remote attacker with access to a valid CA endpoint read and write files on the Cognos Analytics system. The issue is docu...

CVE-2020-4520

IBM Cognos Analytics (11.0 and 11.1) is affected by CVE-2020-4520, a code-injection vulnerability that could allow a remote attacker to inject HTML and have it execute when viewed by an authenticated user. The root cause is an injection issue in Cognos Analytics, enabling cross-site code executio...

CVE-2020-4520

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the code. IBM X-Force ID: 182395...

CVE-2020-4354

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178506...

CVE-2020-4300

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 176607...

CVE-2019-4730

CVE-2019-4730 affects IBM Cognos Analytics 11.0 and 11.1, where XML data processing is vulnerable to XML External Entity (XXE) injection. The root cause, as described in connected sources, is an XXE flaw that could allow a remote attacker to view sensitive information or exhaust memory resources....

CVE-2019-4724

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Content Backup page. IBM X-Force ID: 172130...

CVE-2019-4723

CVE-2019-4723 affects IBM Cognos Analytics 11.0 and 11.1, where a remote attacker could obtain credentials from a user's browser due to incorrect autocomplete settings in the New Data Server Connection page. Root cause/impact are described in IBM/IBM X-Force references; cloud versions are address...

CVE-2019-4723

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data Server Connection page. IBM X-Force ID: 172129...

CVE-2019-4722

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information via a stack trace due to mishandling of certain error conditions. IBM X-Force ID: 172128...

CVE-2019-4471

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive cookie in an HTTPS session. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 163780...

CVE-2021-20585

CVE-2021-20585 affects IBM Security Verify Access 20.07. It allows disclosure of sensitive information via HTTP server headers (partial confidentiality impact). No explicit root cause or remediation details are provided in the connected documents; exploitation status not described. Monitor for up...

CVE-2021-20585

IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Force ID: 199398...

CVE-2021-20575

CVE-2021-20575 concerns IBM Application Gateway (IBM Application Gateway 1.0) where the application allows web pages to be stored locally and readable by other users on the same system, causing an information disclosure. The vulnerability description and multiple connected sources confirm this lo...

CVE-2021-20575

IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278...

CVE-2021-20486

IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. IBM X-Force ID: 197668...

Information disclosure

IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. IBM X-Force ID: 197668...

Xxe

IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793...