Vulnerabilidades

IBM Transformation Extender Advanced 10.0.1 stores potentially sensitive information in log files that could be read by a local user.

IBM Planning Analytics Local 2.0.0 hasta 2.0.106 y 2.1.0 hasta 2.1.13 podría permitir a un usuario privilegiado malicioso eludir la interfaz de usuario para obtener acceso no autorizado a información sensible debido a la validación incorrecta de la entrada.

IBM Planning Analytics Local 2.0.0 hasta 2.0.106 y 2.1.0 hasta 2.1.13 es vulnerable a cross-site scripting. Esta vulnerabilidad permite a un usuario autenticado incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista y potencialmente llevando a la divulgación de…

IBM InfoSphere 11.7.0.0 hasta 11.7.1.6 Servidor de Información podría permitir a un usuario autenticado ejecutar comandos arbitrarios con privilegios elevados en el sistema debido a una validación incorrecta de la entrada proporcionada por el usuario.

IBM WebSphere Servidor de Aplicaciones 8.5 y 9.0 es vulnerable a una denegación de servicio, causada por el envío de una solicitud especialmente diseñada. Un usuario privilegiado podría explotar esta vulnerabilidad para hacer que el servidor consuma recursos de memoria.

IBM License Metric Tool 9.2.0 hasta 9.2.40 es vulnerable a cross-site scripting almacenado. Esta vulnerabilidad permite a un usuario autenticado incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista y lo que podría llevar a la divulgación de credenciales dentro…

IBM License Metric Tool 9.2.0 hasta 9.2.40 podría permitir a un usuario autenticado eludir los controles de acceso en la interfaz de la API REST y realizar acciones no autorizadas.

IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

IBM Storage TS4500 Biblioteca 1.11.0.0 y 2.11.0.0 es vulnerable a cross-site scripting. Esta vulnerabilidad permite a un atacante no autenticado incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista, lo que podría llevar a la divulgación de credenciales dentro de…

IBM Lakehouse (watsonx.data 2.2) almacena información potencialmente sensible en archivos de registro que podría ser leída por un usuario local.

IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies.

IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.

IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.

IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings passed as an argument from an external source.

IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

IBM Copy Services Manager 6.3.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks against the system.

IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input.

IBM Lakehouse (watsonx.data 2.2) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with root privileges due to improper initialization of critical variables.

IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.

IBM PowerVM Hypervisor FW950.00 through FW950.E0, FW1050.00 through FW1050.50, and FW1060.00 through FW1060.40 could allow a local privileged user to cause a denial of service by issuing a specially crafted IBM i hypervisor call that would disclose memory contents or consume excessive memory resources.

IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files due to improper permission assignment.

IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions.