CVE-2024-35151

CVE-2024-35151 concerns IBM OpenPages with Watson 8.3 and 9.0, where authenticated users could access sensitive information due to improper authorization controls on APIs. The Red Hat/CNVD/NVD records align on the affected products/versions (IBM OpenPages with Watson 8.3; IBM OpenPages 9.0) and t...

CVE-2024-27257

IBM OpenPages is affected (versions 8.3 and 9.0). The issue is exposure of information about client-side source code via JavaScript source maps, enabling disclosure to unauthorized users. Root cause details indicate that source maps are not required for functionality and should be disabled or fix...

CVE-2017-1300

CVE-2017-1300 concerns cross-site request forgery in IBM OpenPages GRC Platform versions 7.1–7.3. The vulnerability could allow a malicious action to be executed within a trusted user session. The IBM advisory states affected components as the OpenPages GRC Platform and provides remediation by ap...

CVE-2017-1148

The CVE-2017-1148 entry applies to IBM OpenPages GRC Platform versions 7.2–7.3 with the OpenPages Loss Event Entry (LEE) application. The root cause is described as insecure object reference leading to information disclosure of sensitive data, including private APIs, which could be leveraged for ...

CVE-2015-0144

IBM OpenPages GRC Platform is affected by CVE-2015-0144 (XSS) across versions 6.2 (before IF7) through 7.1 (before FP1). The issue arises from improper validation of user-supplied input, allowing a remote authenticated user to inject and execute web scripts via a crafted URL, potentially stealing...

CVE-2016-3048

CVE-2016-3048 affects IBM OpenPages GRC Platform versions 7.1, 7.2, and 7.3, with a cross-site scripting (XSS) vulnerability in the Web UI that can allow embedding arbitrary JavaScript within a trusted session. The IBM security bulletin for OpenPages confirms XSS in multiple CVEs (including CVE-2...

CVE-2017-1290

IBM OpenPages GRC Platform versions 7.1–7.3 are reported vulnerable to cross-site scripting, allowing an attacker to inject JavaScript into the Web UI. The issue affects OpenPages GRC Platform 7.1, 7.2, and 7.3 as described in IBM’s bulletin. Remediation is provided via versioned fixes: 7.3.0.1 o...

CVE-2017-1333

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 expose an information disclosure vulnerability that allows an unauthenticated user to obtain sensitive server information, which could be used to plan future attacks. The provided documents do not disclose the root cause details, exploit steps, or a sp...

CVE-2017-1147

IBM OpenPages GRC Platform versions 7.1–7.3 are affected by a cross-site scripting vulnerability in the Web UI. The issue allows injection of arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Remediation: apply fixes as follows—OpenPages 7.3: 7.3 Fix Pa...

CVE-2017-1679

IBM OpenPages GRC Platform versions 7.2–8.0 are affected by CVE-2017-1679, an information-disclosure vulnerability that could allow an attacker to obtain sensitive data from error log files. The IBM security bulletin confirms the affected products and provides remediation: apply fixes for each ve...

CVE-2015-5049

IBM OpenPages GRC Platform is affected by a blind SQL injection in the API (CVE-2015-5049). Affected versions are OpenPages GRC Platform 7.1 (before 7.1.0.1 IF6) and 7.0 (before 7.0.0.4 IF3). An attacker could remotely craft SQL statements to view, add, modify, or delete data in the backend datab...

CVE-2016-3049

IBM OpenPages GRC Platform is affected by CVE-2016-3049: HTML injection in versions 7.1–7.3. A remote attacker could inject HTML that executes in the victim’s browser within the hosting site’s context. IBM’s bulletin lists fixes per version: 7.3 Fix Pack 1 (7.3.0.1) or later, 7.2 Fix Pack 3 (7.2....

CVE-2020-4535

OpenPages GRC Platform 8.1 is affected by a cross-site scripting (XSS) vulnerability in the Web UI that allows embedding arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. Root cause: improper input/output handling in the Web UI. Affected product/version:...

CVE-2011-1381

Technical details for CVE-2011-1381 are not present in the provided documents. The entries only state a generic access-bypass vulnerability in IBM OpenPages GRC Platform 6.1.0.1 before IF4; monitor for future updates.

CVE-2015-0142

IBM OpenPages GRC Platform (versions 6.2–7.1) is affected by CVE-2015-0142 due to insufficient access checks for the System Administration Mode function, allowing remote authenticated users to transition to maintenance mode and trigger a data-storage outage. The vulnerability affects 6.2 before I...

CVE-2015-0145

Affected product: IBM OpenPages GRC Platform (versions 6.2 through 7.1). The CVE-2015-0145 issue is a Cross-Site Request Forgery (CSRF) vulnerability caused by improper validation of user-supplied input that allows remote authenticated users to hijack the authentication of arbitrary users for cer...

CVE-2016-0234

CVE-2016-0234 affects IBM OpenPages GRC Platform versions 7.1–7.3. The issue resides in bundled IBM Cognos Business Intelligence components, allowing a local attacker to obtain sensitive information when a user logs out but does not close the browser. The connected IBM bulletin confirms affected ...

CVE-2014-3011

IBM OpenPages GRC Platform 6.1.0.1 before IF4 is affected by CVE-2014-3011. The vulnerability allows remote attackers to perform link injection via unspecified vectors, with network access, low attack complexity, no authentication required, and potential partial integrity impact (I). No specific ...

CVE-2014-8916

CVE-2014-8916 affects IBM OpenPages GRC Platform 6.2–7.1. The vulnerability is a cross-site scripting (XSS) issue caused by improper validation of user-supplied input, exploitable by remote authenticated users through a crafted URL to run script in a victim’s browser. Affected versions include 6....

CVE-2015-0141

CVE-2015-0141 affects IBM OpenPages GRC Platform (versions 6.2–7.1). The root cause is insufficient access checks on JSON requests, allowing an authenticated user to modify arbitrary user filters. The vulnerability is documented with multiple related CVEs in IBM’s 2018 bulletin, which lists affec...

CVE-2015-0143

IBM OpenPages GRC Platform is vulnerable to information disclosure via error messages for authenticated users. Affected versions include 6.2 through 7.1 (specifically 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1). The underlying issue is exposure of sensitive infor...

CVE-2020-4536

CVE-2020-4536 affects IBM OpenPages with Watson (GRC Platform) version 8.1, where a remote attacker could obtain sensitive information via a detailed error message returned in the browser. Vulnerable component is within IBM OpenPages GRC Platform 8.1; impact is information disclosure with CVSS ~4...