CVE-2022-33959

CVE-2022-33959 affects IBM Sterling Order Management 10.0. Affects a privilege-escalation channel where a user can bypass validation and perform unauthorized actions on behalf of other users. Root cause cited in IBM and security entries as improper/absent authorization checks in form data handlin...

CVE-2022-34333

IBM Sterling Order Management 10.0 is affected by a design/logic flaw: by default, the system does not require strong passwords, enabling easier account compromise. The vulnerability is network-exploitable with no user interaction (per CVSS: HIGH, AV:N, AC:L, PR:N, UI:N, C:H). The root cause is w...

CVE-2014-0932

CVE-2014-0932 describes a Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 prior to HF105 and Sterling Selling and Fulfillment Foundation 9.0 prior to HF85. The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. The affec...

CVE-2021-20554

CVE-2021-20554 affects IBM Sterling Order Management versions 9.4, 9.5, and 10.0 and is caused by a cross-site scripting (XSS) vulnerability in the Web UI that can allow an attacker to embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. Public source...

CVE-2015-1911

CVE-2015-1911 is an XSS vulnerability in IBM Sterling Selling and Fulfillment Suite components: Sterling Order Management 8.5 (before HF113), Sterling Selling and Fulfillment Foundation 9.0.0 (before FP92), and Sterling Field Sales 9.0 (before HF7). The IBM bulletin (IBM Security Bulletin) attrib...