CVE-2024-45091

IBM UrbanCode Deploy (UCD) versions 7.0–7.0.5.24, 7.1–7.1.2.10, and 7.2–7.2.3.13 store potentially sensitive information in HTTP request log files, which could be read by a local user with access to logs. Root cause: sensitive information is written to log files. Impact: confidentiality of data i...

CVE-2022-22367

CVE-2022-22367 affects IBM UrbanCode Deploy (UCD) and allows a local user to disclose sensitive database information in plain text. Affected versions are UCD 6.0.0.0–6.2.7.15 and 7.0.0.0–7.0.5.10, 7.1.0.0–7.1.2.6, and 7.2.0.0–7.2.2.1. Root cause: information disclosure in plain text stored/retrie...

CVE-2022-22327

IBM UrbanCode Deploy (UCD) is affected by CVE-2022-22327 due to weaker-than-expected cryptographic algorithms that could allow decryption of highly sensitive information. Affected products and versions include UCD 7.0.5.3–7.0.5.7 and 7.1.0.0–7.1.2.4 (inclusive). Remediation: upgrade to 7.0.5.9, 7...

CVE-2024-55904

CVE-2024-55904 affects IBM UrbanCode Deploy (UCD) versions 7.0–7.0.5.25, 7.1–7.1.2.21, 7.2–7.2.3.14, 7.3–7.3.2.9 and IBM DevOps Deploy versions 8.0–8.0.1.4, 8.1–8.1.0.0. The vulnerability is a remote, authenticated command injection (CWE-78) allowing an attacker to execute arbitrary commands on t...

CVE-2021-39082

CVE-2021-39082 affects IBM UrbanCode Deploy (UCD) container images, where use of weaker cryptographic algorithms can enable decryption of highly sensitive information. IBM’s security bulletin confirms non-unique HTTPS certificates and a shared database encryption key in affected container images,...

CVE-2022-22315

IBM UrbanCode Deploy (UCD) CVE-2022-22315 describes an elevation-of-privilege where an authenticated user with special permissions could obtain elevated privileges due to improper handling of permissions. Affected versions include UCD 7.2.2.1, with other disclosures listing broader affected range...

CVE-2022-22366

CVE-2022-22366 affects IBM UrbanCode Deploy (UCD) versions 6.0.0.0–6.2.7.15 and 7.0.0.0–7.2.2.1, where user credentials are stored in plain clear text readable by a local user. The IBM security bulletin describes this as an information-disclosure vulnerability with a CVSS base score around 4.9. R...

CVE-2024-28781

The CVE-2024-28781 entry covers Cross‑Site Scripting in IBM UrbanCode Deploy (UCD). Affected versions are 7.0–7.0.5.20, 7.1–7.1.2.16, 7.2–7.2.3.9, 7.3–7.3.2.4, and 8.0–8.0.0.1, where arbitrary JavaScript can be embedded in the Web UI, potentially altering functionality and exposing credentials wi...

CVE-2022-35716

CVE-2022-35716 affects IBM UrbanCode Deploy (UCD) across multiple lines: 6.2.0.0–6.2.7.16, 7.0.0.0–7.0.5.11, 7.1.0.0–7.1.2.7, and 7.2.0.0–7.2.3.0. The issue stems from improper security checks that can allow an authenticated user to obtain sensitive information in some instances (information disc...

CVE-2024-22334

Summary : CVE-2024-22334 affects IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy, with an incomplete revocation of permissions when deleting a custom security resource type. The issue can cause associated permissions of objects using that type to remain or be misreported, leading to inaccurate p...

CVE-2022-40751

CVE-2022-40751 affects IBM UrbanCode Deploy (UCD) versions: 6.2.7.0–6.2.7.17; 7.0.0.0–7.0.5.12; 7.1.0.0–7.1.2.8; 7.2.0.0–7.2.3.1. An administrator with "Manage Security" permissions could recover credentials saved for LDAP authentication, exposing sensitive data. IBM X-Force ID: 236601. The fixed...

CVE-2024-22359

CVE-2024-22359 affects IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy. A cross-site scripting vulnerability exists in the Web UI that can allow embedding arbitrary JavaScript to alter functionality and potentially disclose credentials within a trusted session. Affected versions are UCD 7.0–7.0....

CVE-2024-56469

IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy are affected by a missing authentication issue in the Agent Relay service that could allow unauthorized access to other services or exposure of sensitive data. Affected versions include UCD 7.1–7.1.2.22, 7.2–7.2.3.15, 7.3–7.3.2.10 and DevOps Deploy...

CVE-2023-40376

CVE-2023-40376 affects IBM UrbanCode Deploy (UCD) versions 7.1‑7.3.2.x under certain configurations. The root cause is improper authentication controls that could allow an authenticated user to change environment variables. Impact described by sources: potential unauthorized modifications to envi...

CVE-2022-46771

CVE-2022-46771 affects IBM UrbanCode Deploy (UCD) versions 6.2.0.0–6.2.7.18, 7.0.5.0–7.0.5.13, 7.1.0.0–7.1.2.9, 7.2.0.0–7.2.3.2 and 7.3.0.0, with a cross-site scripting vulnerability that can lead to arbitrary JavaScript in the Web UI and potential credentials disclosure within a trusted session....

CVE-2024-22331

CVE-2024-22331 affects IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy. The issue could disclose sensitive user information when installing the Windows agent as a service, impacting UCD versions: 7.0–7.0.5.19, 7.1–7.1.2.15, 7.2–7.2.3.8, 7.3–7.3.2.3, and DevOps Deploy 8.0.0.0. Root cause is infor...

CVE-2024-22358

IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy are affected by CVE-2024-22358: upon logout, sessions are not invalidated, allowing an authenticated user to impersonate another user. Affected versions include UCD 7.0–7.0.5.20, 7.1–7.1.2.16, 7.2–7.2.3.9, 7.3–7.3.2.4 and DevOps Deploy 8.0–8.0.0.1....

CVE-2025-1998

CVE-2025-1998 affects IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy. The vulnerability stems from storing potentially sensitive authentication token information in log files, which could be read by a local user. Affected product versions include UCD 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, ...

CVE-2016-6068

IBM UrbanCode Deploy is affected by CVE-2016-6068. The IBM Security Bulletin confirms that an authenticated user with REST endpoint access could access API and CLI getResource secured role properties. Affected versions include 6.0.x through 6.2.x series listed in the bulletin, with remediation vi...

CVE-2024-51472

CVE-2024-51472 affects IBM UrbanCode Deploy (UCD) versions 7.2 (up to 7.2.3.13), 7.3 (up to 7.3.2.8), and IBM DevOps Deploy 8.0–8.0.1.3. The issue is HTML injection in the Web UI that may disclose sensitive information. Remediation is to upgrade to one of: 7.2.3.14, 7.3.2.9, 8.0.1.4, or 8.1.0.0 o...

CVE-2022-43877

IBM UrbanCode Deploy (UCD) could disclose sensitive password information when a manual edit of the agentrelay.properties file is made, due to the value not being automatically encrypted after restart. Affected versions include 6.2.0.0 to 6.2.7.19; 7.0 to 7.0.5.14; 7.1 to 7.1.2.10; 7.2 to 7.2.3.3;...

CVE-2024-22339

CVE-2024-22339 affects IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy, with the root cause being insufficient obfuscation of sensitive values in some log files, leading to potential sensitive information disclosure. Affected products and versions include: UCD 7.0–7.0.5.20, 7.1–7.1.2.16, 7.2–7.2...

CVE-2024-54176

CVE-2024-54176 affects IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy. The vulnerability arises from missing authorization for a function, enabling an authenticated user to obtain sensitive information about other users on the system (CWE-306). Affected are UCD versions 7.0–7.0.5.25, 7.1–7.1.2....

CVE-2025-1997

IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy contain an HTML injection vulnerability (CVE-2025-1997) in the Web UI. Affected versions include UCD 7.0–7.0.5.25, 7.1–7.1.2.21, 7.2–7.2.3.14, 7.3–7.3.2.0, and DevOps Deploy 8.0–8.0.1.4 and 8.1–8.1. The issue may allow embedding arbitrary HTML tags...

CVE-2016-0364

CVE-2016-0364 affects IBM UrbanCode Deploy: versions 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not obfuscate secure-property values correctly in step output logs, enabling a remote authenticated user to obtain sensitive information via vectors involving special char...

CVE-2017-1286

CVE-2017-1286 affects IBM UrbanCode Deploy 6.1–6.9.6.0, where a user with elevated UI permissions can obtain sensitive server/database configuration data even after privileges are revoked. The IBM Security Bulletin confirms an information-disclosure vulnerability in UCD diagnostics files, with af...

CVE-2020-4848

IBM UrbanCode Deploy (UCD) has a confirmed information-disclosure/privilege-elevation issue (CVE-2020-4848) affecting 6.2.7.9, 7.0.5.4, and 7.1.1.1. An authenticated user could initiate a plugin or compare process resources they should not access due to insufficient execute permissions. The IBM s...

CVE-2016-0373

IBM UrbanCode Deploy CVE-2016-0373 enables information disclosure via REST endpoints not properly authorizing readers. Affected versions are 6.0 through 6.2.2.1 (inclusive). The root cause is an authorization failure in UCD REST endpoints that allows an authenticated user to read sensitive data. ...

CVE-2019-4667

CVE-2019-4667 affects IBM UrbanCode Deploy (UCD). The IBM security bulletin and NVD entries indicate that UCD versions affected include 7.0.5.2 and earlier, with the root cause being failure to properly enable HTTP Strict Transport Security (HSTS). This omission can allow a remote attacker to obt...

CVE-2020-4484

IBM UrbanCode Deploy (UCD) versions affected by CVE-2020-4484 are 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0. The vulnerability, described by the IBM security bulletin, arises from GENERIC PROCESS PROPERTIES NOT BEING TREATED AS SECURE when a process is run through a RUN GENERIC PROCESS STEP, enablin...

CVE-2014-8900

IBM UrbanCode Release is vulnerable to cross-site request forgery (CSRF) due to improper validation of user-supplied input. A remote attacker could entice an authenticated user to visit a malicious site to send crafted requests, potentially enabling cross-site scripting, web cache poisoning, and ...

CVE-2016-0320

CVE-2016-0320 affects IBM UrbanCode Deploy. Description: an authenticated user could modify UCD objects via multiple REST endpoints that do not properly authorize edits, potentially altering behavior of legitimately triggered processes. Affected versions include UrbanCode Deploy 6.0 through 6.2.x...

CVE-2017-1752

CVE-2017-1752 affects IBM UrbanCode Deploy 6.1 (up to 6.1.3.8) and 6.2 (up to 6.2.7.0). The issue allows an authenticated privileged user to obtain highly sensitive information due to improper access controls in the deployment tool. Affected versions: IBM UrbanCode Deploy 6.1.x and 6.2.x. The rem...

CVE-2020-4884

CVE-2020-4884 affects IBM UrbanCode Deploy (UCD) versions 6.2.7.9, 7.0.5.4, and 7.1.1.1. The root cause is storing user credentials in plaintext, which can be read by a local user. Consequence: credential disclosure from plaintext storage. References in IBM advisories align with NVD details. Reme...

CVE-2014-6074

IBM UrbanCode Deploy 6.1.0.2 before IF1 is affected. The flaw allows remote authenticated users to read keystore secret keys via direct access to a UI page, potentially exposing all encrypted values and SSL communications between server and agents. The IBM security bulletin notes the affected pro...

CVE-2016-8938

CVE-2016-8938 affects IBM UrbanCode Deploy (UCD). The vulnerability allows remote code execution via a crafted file upload that replaces server code, with potential execution on UCD agent machines hosting production apps. IBM’s advisory lists affected versions (e.g., 6.0.x, 6.1.x, 6.2.x lines) an...

CVE-2017-1749

IBM UrbanCode Deploy 6.1–6.9.6.0 is affected by CVE-2017-1749, a directory traversal vulnerability that could allow an unauthenticated remote attacker to upload or replace plugins and thereby alter deployments. The IBM security bulletin notes that all fixpacks of UrbanCode Deploy 6.1 (up to 6.1.3...

CVE-2020-4944

CVE-2020-4944 affects IBM UrbanCode Deploy (UCD) versions 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, 7.1.1.2. The issue is that keystore passwords are stored in plain text after a manual edit, allowing a local user to read them. The IBM security bulletin confirms this behavior...

CVE-2016-0271

IBM UrbanCode Deploy hardening advisory (CVE-2016-0271) affects agents that do not verify the server identity in JMS and HTTP sessions, enabling local privilege escalation to root on affected agents. Affected versions include IBM UrbanCode Deploy 6.x prior to 6.0.1.14, 6.1.x prior to 6.1.3.3, and...

CVE-2016-2994

CVE-2016-2994 describes a Cross-site scripting (XSS) vulnerability in IBM UrbanCode Deploy 6.2.x prior to 6.2.1.2. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The root cause is related to vulnerable input handling in the 6.2.x line, ...

CVE-2020-4202

CVE-2020-4202 affects IBM UrbanCode Deploy (UCD) versions 7.0.3.0 and 7.0.4.0. The IBM advisory states that an authenticated user could impersonate another user if the server is configured to enable Distributed Front End (DFE). The vulnerability’s exploit requires DFE to be enabled and arises fro...

CVE-2023-47161

IBM UrbanCode Deploy (UCD) is affected by CVE-2023-47161 due to mishandling input validation of an uploaded archive file, causing a denial of service from resource exhaustion. Affected versions are 7.0–7.0.5.18, 7.1–7.1.2.14, 7.2–7.2.3.7, and 7.3–7.3.2.2. Remediation guidance recommends upgrading...

CVE-2016-9008

IBM UrbanCode Deploy contains a vulnerability where a malicious user could access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent. Public details indicate a network-exposed vector with no authentication, high integrity impact, but the provided sources do not specify a f...

CVE-2017-1493

IBM UrbanCode Deploy (UCD) 6.1 (6.1.0–6.1.3.6) and 6.2 (6.2.0–6.2.6.1) are affected by CVE-2017-1493, where an authenticated user could edit objects they should not have access to due to improper access controls. The advisory from IBM reiterates that previous releases allow unauthorized edits. Re...

CVE-2023-42015

IBM UrbanCode Deploy (UCD) versions affected: 7.1 up to 7.1.2.14, 7.2 up to 7.2.3.7, and 7.3 up to 7.3.2.2 are vulnerable to HTML injection in the Web UI, potentially enabling disclosure of sensitive information. Root cause is an HTML injection vulnerability in the UI. CVSS base score is 4.3 (LOW...

CVE-2015-7415

IBM UrbanCode Deploy is affected by CVE-2015-7415 via multiple persistent XSS vulnerabilities caused by improper validation of user-supplied input. A remote authenticated attacker can exploit a crafted URL to execute script in a victim’s browser. Affected versions include 6.0 before 6.0.1.12, 6.1...

CVE-2016-2941

The CVE-2016-2941 entry impacts IBM UrbanCode Deploy. Affected behavior is that during step execution, the product creates temporary files which may contain sensitive information, including passwords, that could be read by a local user. The documents do not provide specifics on vulnerable version...

CVE-2016-2942

CVE-2016-2942 affects IBM UrbanCode Deploy. An authenticated user with special permissions can craft a script on the server that causes processes to run on a remote UCD agent machine. The IBM advisory lists affected versions (6.0–6.2.x) and provides fixes: upgrade to 6.2.3 (for 6.2.x) or 6.1.3.4 ...

CVE-2021-29711

CVE-2021-29711 affects IBM UrbanCode Deploy (UCD) versions including 6.2.7.3/4/8/9, 7.0.3.0/4.0/5.4, 7.1.0.0/1.0/1.1/1.2, and 7.1.1.x. The IBM security bulletin notes that an authenticated user with certain permissions could initiate an agent upgrade through the CLI interface, due to inconsistent...

CVE-2017-1149

CVE-2017-1149 affects IBM UrbanCode Deploy (UCD) versions 6.0, 6.1, and 6.2. The vulnerability is an XML External Entity (XXE) injection in XML data processing, enabling a remote attacker to cause a denial of service and potentially disclose sensitive information or exhaust memory resources. The ...