CVE-2019-4193

IBM Jazz for Service Management versions 1.1.3–1.1.3.2 expose sensitive information via URL parameters, enabling potential disclosure if URLs are logged or exposed through referrers or browser history. The IBM advisory (and NVD entry) confirm the affected product and the risk vector, with CVSS de...

CVE-2022-35722

CVE-2022-35722 affects IBM Jazz for Service Management (JazzSM). The vulnerability is a stored cross-site scripting issue in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected product/version from...

CVE-2019-4201

CVE-2019-4201 affects IBM Jazz for Service Management versions 1.1.3–1.1.3.2. The issue is an open redirect vulnerability that could allow a remote attacker to perform phishing by guiding a victim to a crafted site, spoofing the URL and redirecting to a malicious site. IBM lists a CVSS base score...

CVE-2024-47106

IBM Jazz for Service Management (versions 1.1.3 through 1.1.3.22) has a vulnerability (CVE-2024-47106) caused by improper access restrictions in a directory, leading to potential exposure of sensitive information that could aid further attacks. The issue is documented by IBM with a remediation pa...

CVE-2022-35721

IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting (CVE-2022-35721), allowing embedded JavaScript in the Web UI and potentially credential disclosure within a trusted session. Affected product: Jazz for Service Management 1.1.3 (WebGUI inclusion via Tivoli Netcool/...

CVE-2024-52892

IBM Jazz for Service Management versions 1.1.3–1.1.3.23 are affected by CVE-2024-52892 due to a cross-site scripting vulnerability in the Web UI (via the searchWord parameter on the static help page). The vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript, potentially ...

CVE-2021-29831

CVE-2021-29831 affects IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI via an XML External Entity (XXE) vulnerability when processing XML data. Impact: potential disclosure of sensitive information or memory resource consumption. Root cause: XXE in XML processing. Reme...

CVE-2021-29815

CVE-2021-29815 concerns IBM Jazz for Service Management (JazzSM) 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI WebGUI. The connected sources confirm a stored cross-site scripting (XSS) vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to cre...

CVE-2021-29832

CVE-2021-29832 affects IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI WebGUI. The issue is a stored cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trus...

CVE-2021-29816

CVE-2021-29816 affects IBM Jazz for Service Management (JazzSM) 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI via a cross-site request forgery (CSRF) vulnerability that could allow an attacker to perform actions transmitted from a trusted user. IBM IBM Jazz for Service Management is vulnerable to C...

CVE-2019-4186

CVE-2019-4186 affects IBM Jazz for Service Management 1.1.3, via an HTTP header injection flaw caused by incorrect trust in the Host header during caching. A remote attacker could send a crafted HTTP GET to inject arbitrary headers, enabling attacks such as cross-site scripting, cache poisoning, ...

CVE-2017-1631

IBM Jazz for Service Management (JazzSM) 1.1.3 in Tivoli Netcool/OMNIbus WebGUI is affected by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2017-1631). Affected: JazzSM v1.1.3; WebGUI 8.1.0 GA and FP. Root cause: CSRF in JazzSM; vulnerability allows an attacker to perform unauthorized a...

CVE-2021-29905

CVE-2021-29905 affects IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI. The issue is a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. T...

CVE-2023-46186

CVE-2023-46186 affects IBM Jazz for Service Management 1.1.3.20. The root cause is improper access controls that enable an unauthorized user to obtain sensitive file information via forced browsing. Impact details from sources indicate a high confidentiality risk (NVD CVSS v3.1 base 7.5; IBM CNA ...

CVE-2019-4194

IBM Jazz for Service Management versions 1.1.3–1.1.3.2 are affected by a missing function level access control allowing a user to delete authorized resources. Root cause: insufficient access control at function level. Impact: potential deletion of authorized resources. Mitigation: apply the fix 1...

CVE-2021-29833

CVE-2021-29833 affects IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI WebGUI. The vulnerability is stored cross-site scripting that could allow embedding arbitrary JavaScript in the Web UI and potentially lead to credentials disclosure within a trusted session. Affect...

CVE-2019-4275

The CVE-2019-4275 issue affects IBM Jazz for Service Management versions 1.1.3 through 1.1.3.2, where an unauthorized local user can create unique catalog names that lead to a denial of service. The NVD entry lists a high availability impact (CVSS v3 base score 5.5, MEDIUM) with LOCAL attack vect...

CVE-2017-1746

CVE-2017-1746 affects IBM Jazz for Service Management (JazzSM) version 1.1.3, vulnerable to Cross-Site Request Forgery (CSRF) that could enable malicious actions transmitted from a trusted user. Remediation is available: JazzSM 1.1.3 with Cumulative Patch Level 5 (1.1.3.0-TIV-JazzSM-DASH-Cumulati...

CVE-2021-29814

CVE-2021-29814 affects IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI WebGUI, with a stored cross-site scripting flaw that can embed arbitrary JavaScript in the Web UI and potentially disclose credentials within a trusted session. Public references describe the affect...

CVE-2021-29812

CVE-2021-29812 affects IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI Web UI. Root cause: stored cross-site scripting due to insufficient input filtering/escaping in the Web UI. Impact: potential for arbitrary JavaScript execution and credential disclosure within a tr...

CVE-2021-29904

CVE-2021-29904 concerns IBM Jazz for Service Management 1.1.3.10 and its IBM Tivoli Netcool/OMNIbus_GUI, where user credentials are exposed in plaintext to a local user via the GUI. The vulnerability stems from information disclosure in the affected components, enabling local access to credential...

CVE-2021-38877

IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting in the Web UI, potentially allowing an attacker to embed arbitrary JavaScript and cause credential disclosure in a trusted session. The vulnerability is identified as CVE-2021-38877. IBM/IBM X-Force references a...

CVE-2021-29800

CVE-2021-29800 affects IBM Jazz for Service Management and Tivoli Netcool/OMNIbus_GUI WebGUI (version 1.1.3.10). The issue is a stored cross-site scripting vulnerability in the Web UI that can allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a ...

CVE-2021-29810

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI are affected by a stored cross-site scripting (XSS) vulnerability. The issue allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Remediation per IBM...

CVE-2021-29813

CVE-2021-29813 affects IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI WebGUI. The issue is stored cross-site scripting caused by insufficient filtering/escaping in the Web UI, enabling arbitrary JavaScript execution that could lead to credentials disclosure within a t...

CVE-2019-4718

IBM Jazz for Service Management is vulnerable to cross‑site scripting (CVE-2019-4718) in its Web UI, potentially allowing injection of arbitrary JavaScript and credential disclosure within a trusted session. The CVE entry notes affected version 3.13 with an overall CVSS v3.0 base score of 5.4 (ME...

CVE-2025-36011

CVE-2025-36011 affects IBM Jazz for Service Management versions 1.1.3.0–1.1.3.24. The underlying issue is that authorization tokens and session cookies are stored without the Secure attribute, enabling cookie disclosure if a user is directed to or visits an insecure HTTP link. This could allow an...

CVE-2025-36249

IBM Jazz for Service Management versions 1.1.3.0–1.1.3.25 do not set the Secure attribute on authorization tokens or session cookies, enabling potential cookie theft via http links or injected sites. Remediation per IBM/Red Hat entries: upgrade to JazzSM 1.1.3.26 (1.1.3-TIV-JazzSM-multi-FP026). A...