CVE-2022-22328

IBM Sterling Partner Engagement Manager Standard Edition 6.2.0 contains a privilege-escalation vulnerability that could allow a malicious user to perform unintended operations on other users’ data. The issue is documented in multiple feeds (NVD entry CVE-2022-22328, with CVSSv3.1 base score 6.2 a...

CVE-2022-22331

The CVE-2022-22331 issue affects IBM Sterling Partner Engagement Manager Standard Edition 6.2.0, due to an insecure direct object vulnerability (IDOR). A remote authenticated attacker could disclose sensitive information or modify user details (impact per sources). Remediation exists: IBM lists F...

CVE-2022-22332

IBM Sterling Partner Engagement Manager 6.2.0 is affected by an impersonation vulnerability caused by a missing revocation mechanism for JWT tokens. The issue enables an attacker to impersonate another user and is documented in multiple sources (IBM bulletin, NVD entry). Affected product: IBM Ste...

CVE-2022-34354

Affected product: IBM Sterling Partner Engagement Manager 2.0. The vulnerability is an information disclosure where encrypted client data stored locally can be read by another user on the same system. Root cause: inadequate protection of locally stored data leading to exposure. Impact: confidenti...

CVE-2022-22360

IBM Sterling Partner Engagement Manager is affected by an LDAP injection vulnerability (CVE-2022-22360) in versions 6.1.2, 6.2 and Cloud/SaaS 22.2. The flaw enables a remote authenticated attacker to manipulate LDAP queries, potentially granting permissions to unauthorized resources. Affected edi...

CVE-2022-22359

CVE-2022-22359 affects IBM Sterling Partner Engagement Manager (Essentials/Standard editions 6.1.2, 6.2; Cloud/SaaS 22.2). Root cause: a cross-site request forgery (CSRF) flaw stemming from insufficient validation of a user request parameter, enabling an attacker to perform malicious actions on b...

CVE-2022-22416

IBM Sterling Partner Engagement Manager is affected by CVE-2022-22416 (SSRF) in versions 6.1.2, 6.2, and Cloud/SaaS 22.2. The root cause is input validation failure that allows an authenticated attacker to cause the system to issue unauthorized requests, potentially enabling network enumeration a...

CVE-2022-22417

IBM Sterling Partner Engagement Manager is affected by a cross-site scripting (XSS) vulnerability (CVE-2022-22417). The issue arises from insufficient validation/filtering of user-supplied data in the Web UI, potentially allowing an attacker to embed arbitrary JavaScript and alter functionality, ...

CVE-2022-22358

The CVE-2022-22358 issue affects IBM Sterling Partner Engagement Manager: XXE in XML processing impacts the following products/versions—Essentials Edition 6.1.2, Standard Edition 6.1.2, Essentials Edition 6.2, Standard Edition 6.2, and Cloud/SaaS 22.2. The root cause is an XML External Entity vul...

CVE-2021-29781

CVE-2021-29781 affects IBM Sterling Partner Engagement Manager 2.0. The root cause is an unsafe deserialization flaw that could allow a remote attacker to execute arbitrary code by sending specially crafted data. The IBM Security Bulletin confirms a remote-code-execution impact with high/critical...