CVE-2018-1921

IBM Campaign (versions 9.1.0–11.0) is reported vulnerable to Cross-Site Scripting in the Web UI, enabling injection of arbitrary JavaScript that could lead to credential disclosure within a trusted session. The CVE notes an XSS issue; exploitation details are not provided in the primary sources. ...

CVE-2018-2021

CVE-2018-2021 affects IBM QRadar SIEM 7.2 and 7.3. Vulnerability is a cross-site scripting flaw that lets an attacker embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Root cause stems from untrusted input in the web interface being ...

CVE-2019-4211

IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159131...

CVE-2019-4131

IBM Application Performance Management IBM Monitoring 8.1.4 could allow a remote attacker to induce the application to perform server-side DNS lookups of arbitrary domain names. IBM X-Force ID: 158270...

CVE-2019-4193

IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-force ID: 159032...

CVE-2019-4263

IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 160015...

CVE-2018-1968

IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153749...

Design/Logic Flaw

IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 160015...

Information disclosure

IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-force ID: 159032...

Design/Logic Flaw

IBM Multicloud Manager 3.1.0, 3.1.1, and 3.1.2 ibm-mcm-chart could allow a local attacker with admin privileges to obtain highly sensitive information upon deployment. IBM X-Force ID: 158144...

Information disclosure

IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153749...

Code injection

IBM Application Performance Management IBM Monitoring 8.1.4 could allow a remote attacker to induce the application to perform server-side DNS lookups of arbitrary domain names. IBM X-Force ID: 158270...

CVE-2019-4263

IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 160015...

CVE-2019-4118

IBM Multicloud Manager 3.1.0, 3.1.1, and 3.1.2 ibm-mcm-chart could allow a local attacker with admin privileges to obtain highly sensitive information upon deployment. IBM X-Force ID: 158144...

CVE-2019-4263

IBM Content Navigator 3.0CD is affected by CVE-2019-4263, a local file inclusion vulnerability in the ICN server. The issue allows access to sensitive configuration files via ICN URLs, with a CVSS v3.1/base score of 4.3 (NETWORK, LOW complexity, privileges LOW, no user interaction). Affected prod...

CVE-2019-4193

IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-force ID: 159032...

CVE-2019-4118

CVE-2019-4118 affects IBM Multicloud Manager (ibm-mcm-chart) versions 3.1.0–3.1.2. A local attacker with admin privileges could obtain highly sensitive information upon deployment. The IBM bulletin recommends patches for 3.1.1 and 3.1.2, upgrading 3.1.0 to 3.2.0, and applying fixes via FixCentral...

CVE-2019-4193

IBM Jazz for Service Management versions 1.1.3–1.1.3.2 expose sensitive information via URL parameters, enabling potential disclosure if URLs are logged or exposed through referrers or browser history. The IBM advisory (and NVD entry) confirm the affected product and the risk vector, with CVSS de...

CVE-2019-4129

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to obtain sensitive information, caused by an error message containing a stack trace. By creating an error with a stack trace, an attacker could exploit this vulnerability to potentially obtain details on the...

CVE-2019-4292

IBM Security Guardium 10.5 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable web server. IBM X-Force ID: 160698...