CVE Vulnerability Catalog

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.

A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected is an unknown functionality of the file login.php. Manipulation of the argument user/pass leads to SQL injection. The attack may be performed remotely, and the exploit has been disclosed publicly. This product utilizes a rolling release system, so version information is not disclosed. The vendor was contacted but did not respond.

A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache fails to key its cached tokens by the requested audience. Consequently, a valid, unexpired token minted for a sensitive service (Service A) can be retrieved from the cache and sent to a secondary service (Service B). An attacker who operates, compromises, or monitors traffic to Service B can capture this token and replay it to impersonate the victim application against Service A.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift uses hard-coded cryptographic keys and initialization vectors. As a result, a remote authenticated attacker could obtain sensitive information and forge authentication tags.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift transmits sensitive information in cleartext. A remote attacker could intercept this traffic and obtain confidential information.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to path traversal. A remote authenticated attacker could modify server files as a result.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift does not properly enforce authorization. A remote authenticated attacker could perform unauthorized payment mutation actions as a result.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift does not properly neutralize HTML input, enabling cross-site scripting (XSS). A remote attacker could execute arbitrary JavaScript in an authenticated user's browser.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift stores credentials with insufficient protection. A local attacker could obtain sensitive information as a result.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift improperly uses reflection with externally controlled input. A remote attacker could cause a denial of service.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift performs improper path canonicalization. A remote attacker could read arbitrary files as a result.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a buffer overflow vulnerability. A remote authenticated attacker could exploit it to execute arbitrary code.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift has improper authentication and missing authorization. A remote attacker could perform unauthorized actions.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to server-side request forgery (SSRF). A local attacker could obtain sensitive information and trigger unauthorized actions.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere.