CVE Vulnerability Catalog

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms (versions 3.2.4.0 through 3.2.4.16) is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Cognos Analytics (versions 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2) stores sensitive information in source code, which could be used by an authenticated user in further attacks against the system.

IBM TS4300 versions 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution.

SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.

A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration.

A flaw in Netty's HTTP/1.1 decoder allows a remote attacker to bypass Transfer-Encoding header validation by splitting the field across multiple headers, with the last containing a non-final transfer coding like gzip or deflate. This bypass can lead to HTTP request smuggling.

A flaw in Netty allows a remote attacker to send a specially crafted HTTP request with control characters in the chunk-size line. This bypasses strict validation, allowing injection of arbitrary HTTP requests and request smuggling.

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability. An authenticated user can submit the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php, then inject the unsanitized message ID into a SQL query in cb_pm::delete_msg().

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability. An authenticated user can submit the check_photo parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php, then inject unsanitized values into a SQL query in photo_exists() in photos.class.php.

A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances.

The net_icmpv6_send_error() function in the Zephyr network stack implemented only one of the three RFC 4443 section 2.4 suppression rules, so it did not check whether the packet's source address identifies a single node or whether the packet was sent to a multicast destination. An unauthenticated attacker on the same link can send a single IPv6 packet to ff02::1 with a spoofed victim source, causing every Zephyr node to emit ICMPv6 Parameter Problem messages to that victim (reflection with amplification), or send a unicast packet with a multicast source address, turning it into a link-flooding multicast frame.

The gptp_mi_qualify_announce() function in Zephyr's gPTP subsystem processes received Announce messages by comparing clock identities. The comparison loop uses an attacker-controlled step count (steps_removed) instead of the actual number of TLV entries, leading to an out-of-bounds read. A single frame can cause about 2KB of overread, potentially crashing the networking RX thread and causing denial of service.

A resource exhaustion flaw exists in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can send a specially crafted DER payload, causing excessive memory allocation based on an inflated length value without proper validation, leading to JVM memory exhaustion.

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.

IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4, and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.4 could allow an unauthenticated user to cause a denial of service in the email service due to improper control of interaction frequency.