CVE-2019-4174

CVE-2019-4174 affects IBM Cognos Controller versions 10.2.0–10.4.0, where web pages can be stored locally on disk and read by another user on the same system. The issue is disclosed in the public records for IBM Cognos Controller, with remediation guidance recommending applying the provided fixes...

CVE-2018-1845

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150905...

CVE-2019-4173

IBM Cognos Controller versions 10.2.0–10.4.0 expose an HTTP OPTIONS (Optionsbleed) information-disclosure vulnerability that could allow a remote attacker to read secret data from process memory. Affected: 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.4.0. Root cause: flaw in handling the HTTP OPTIONS metho...

CVE-2019-4103

IBM Tivoli Netcool/Impact 7.1.0 allows for remote execution of command by low privileged User. Remote code execution allow to execute arbitrary code on system which lead to take control over the system. IBM X-Force ID: 158094...

CVE-2019-4176

IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to bypass security restrictions, caused by an error related to insecure HTTP Methods. An attacker could exploit this vulnerability to gain access to the system. IBM X-Force ID: 158881...

CVE-2019-4174

IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158879...

CVE-2019-4136

IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2019-4173

IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OPTIONS method, aka Optionsbleed. By sending an OPTIONS HTTP request, a remote attacker could exploit this vulnerability to read secret data...

CVE-2019-4381

IBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information, caused by the use of advanced node failure detection using the REST API to interface with the HMC. An attacker could exploit this vulnerability to obtain HMC credentials. IBM X-Force ID: 162159...

Cross site scripting

IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162264...

CVE-2019-4403

IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162264...

CVE-2019-4403

IBM Connections 6.0 is affected by a cross-site scripting (XSS) vulnerability in the Web UI, allowing an attacker to embed arbitrary JavaScript to alter functionality and potentially disclose credentials within a trusted session. The root cause cited in CNVD-2019-19316 is lack of proper validatio...

CVE-2019-4381

CVE-2019-4381 affects IBM i clustering (IBM i 7.x) where the REST API interfacing with the HMC via advanced node failure detection can leak HMC credentials to a local attacker. Affected releases include IBM i 7.2–7.4; IBM’s bulletin lists a base score of 5.9 (CVSSv3) with local access, high impac...

CVE-2019-4239

Summary: CVE-2019-4239 affects IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0–3.0.1). Affected systems store user credentials in plain text read-able by a local user. Impact (as stated): Local attacker could access plaintext credentials stored by the Cloud Pak deployment. Public metadata and ...

CVE-2019-4067

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 157012...

CVE-2019-4068

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force ID: 157013...

CVE-2019-4069

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014...

CVE-2019-4070

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Code injection

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force ID: 157013...

Design/Logic Flaw

IBM Intelligent Operations Center IOC 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014...