CVE-2015-0127 | ByteOS Network

Vulnerability Details :

CVE-2015-0127

Assigner-ibm

Assigner Org ID-9a959283-ebb5-44b6-b705-dcc2bbced522

Published At-28 Jun, 2015 | 22:00

Updated At-06 Aug, 2024 | 03:55

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks via a crafted web site.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:ibm

Assigner Org ID:9a959283-ebb5-44b6-b705-dcc2bbced522

Published At:28 Jun, 2015 | 22:00

Updated At:06 Aug, 2024 | 03:55

▼CVE Numbering Authority (CNA)

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks via a crafted web site.

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21902807	x_refsource_CONFIRM

Hyperlink: http://www-01.ibm.com/support/docview.wss?uid=swg21902807

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21902807	x_refsource_CONFIRM x_transferred

Hyperlink: http://www-01.ibm.com/support/docview.wss?uid=swg21902807

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@us.ibm.com

Published At:28 Jun, 2015 | 22:59

Updated At:06 May, 2026 | 22:30

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks via a crafted web site.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N

Type: Primary

Version: 2.0

Base score: 3.5

Base severity: LOW

Vector:

AV:N/AC:M/Au:S/C:N/I:P/A:N

CPE Matches

Weaknesses

CWE ID	Type	Source
CWE-254	Primary	nvd@nist.gov

CWE ID: CWE-254

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21902807	psirt@us.ibm.com	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21902807	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

Hyperlink: http://www-01.ibm.com/support/docview.wss?uid=swg21902807

Source: psirt@us.ibm.com

Resource:

Vendor Advisory

Hyperlink: http://www-01.ibm.com/support/docview.wss?uid=swg21902807

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Similar CVEs

913Records found

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.33% / 55.65%

||

7 Day CHG~0.00%

Published-12 Nov, 2008 | 23:00

Updated-23 Apr, 2026 | 00:35

Multiple cross-site scripting (XSS) vulnerabilities in the web-based interface in IBM Metrica Service Assurance Framework allow remote authenticated users to inject arbitrary web script or HTML via (1) the elementid parameter in a generatedreportresults action to the ReportTree program, (2) the jnlpname parameter to the Launch program, or (3) the :tasklabel parameter to the ReportRequest program, related to the name of a report.

Vendor-n/a IBM Corporation

Product-metrica_service_assurance_framework n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.20% / 41.59%

||

7 Day CHG~0.00%

Published-27 Dec, 2017 | 16:00

Updated-13 May, 2026 | 00:24

IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 126858.

Vendor-IBM Corporation

Product-rational_collaborative_lifecycle_management rational_doors_next_generation rational_software_architect_design_manager rational_quality_manager rational_rhapsody_design_manager rational_engineering_lifecycle_manager rational_team_concert Rational Collaborative Lifecycle Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.17% / 37.32%

||

7 Day CHG~0.00%

Published-16 Aug, 2013 | 01:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to the (1) web console and (2) repository management user interfaces.

Vendor-n/a IBM Corporation

Product-infosphere_information_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.16% / 36.61%

||

7 Day CHG~0.00%

Published-20 Feb, 2013 | 11:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to a uisessionid.

Vendor-n/a IBM Corporation

Product-maximo_asset_management maximo_asset_management_essentials smartcloud_control_desk n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.17% / 37.32%

||

7 Day CHG~0.00%

Published-09 Aug, 2013 | 23:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in IBM Informix Open Admin Tool (OAT) 2.x and 3.x before 3.11.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Vendor-n/a IBM Corporation

Product-informix_open_admin_tool n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.17% / 37.32%

||

7 Day CHG~0.00%

Published-03 Jul, 2013 | 10:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-2983.

Vendor-n/a IBM Corporation

Product-sterling_b2b_integrator sterling_file_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.16% / 36.61%

||

7 Day CHG~0.00%

Published-02 May, 2013 | 18:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a IBM Corporation

Product-lotus_sametime classic_meeting_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.41%

||

7 Day CHG~0.00%

Published-02 Oct, 2017 | 20:00

Updated-13 May, 2026 | 00:24

IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126862.

Vendor-IBM Corporation

Product-rational_engineering_lifecycle_manager Rational Engineering Lifecycle Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.17% / 37.32%

||

7 Day CHG~0.00%

Published-20 Feb, 2013 | 11:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to inject content, and conduct phishing attacks, via unspecified vectors.

Vendor-n/a IBM Corporation

Product-netezza n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 38.60%

||

7 Day CHG~0.00%

Published-03 Jul, 2018 | 19:00

Updated-16 Sep, 2024 | 20:06

IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125727.

Vendor-IBM Corporation

Product-rational_collaborative_lifecycle_management rational_quality_manager Rational Quality Manager Rational Collaborative Lifecycle Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 38.60%

||

7 Day CHG~0.00%

Published-03 Jul, 2018 | 19:00

Updated-17 Sep, 2024 | 00:05

IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125728.

Vendor-IBM Corporation

Product-rational_collaborative_lifecycle_management rational_quality_manager Rational Quality Manager Rational Collaborative Lifecycle Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.17% / 37.32%

||

7 Day CHG~0.00%

Published-20 Feb, 2013 | 11:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to inject arbitrary web script or HTML via vectors involving the MHTML protocol.

Vendor-n/a IBM Corporation

Product-netezza n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.78%

||

7 Day CHG~0.00%

Published-07 Dec, 2017 | 15:00

Updated-13 May, 2026 | 00:24

IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126681.

Vendor-IBM Corporation

Product-atlas_ediscovery_process_management Atlas eDiscovery Process Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-4||MEDIUM

EPSS-0.04% / 13.75%

||

7 Day CHG~0.00%

Published-14 Mar, 2022 | 17:00

Updated-16 Sep, 2024 | 19:31

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Operations Center to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Once clicked, that malicious URL could then rewrite the original page with a phishing page. IBM X-Force ID: 220139.

Vendor-IBM Corporation

Product-spectrum_protect_operations_center Spectrum Protect Operations Center

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.41%

||

7 Day CHG~0.00%

Published-10 Aug, 2017 | 15:00

Updated-13 May, 2026 | 00:24

IBM Rational Engineering Lifecycle Manager 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123187.

Vendor-IBM Corporation

Product-rational_engineering_lifecycle_manager Rational Engineering Lifecycle Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.41%

||

7 Day CHG~0.00%

Published-25 Oct, 2017 | 12:00

Updated-13 May, 2026 | 00:24

IBM DOORS next Generation (DNG/RRC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123188.

Vendor-IBM Corporation

Product-rational_collaborative_lifecycle_management Rational Collaborative Lifecycle Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.17% / 37.32%

||

7 Day CHG~0.00%

Published-20 Feb, 2013 | 11:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a IBM Corporation

Product-netezza n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.19% / 40.31%

||

7 Day CHG~0.00%

Published-06 Mar, 2013 | 11:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Welcome.do in the Data Management Portal Web User Interface in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.x before 7.2.1.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Vendor-n/a IBM Corporation

Product-tivoli_application_dependency_discovery_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.60%

||

7 Day CHG~0.00%

Published-03 Jul, 2018 | 19:00

Updated-17 Sep, 2024 | 01:50

IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124752.

Vendor-IBM Corporation

Product-rational_collaborative_lifecycle_management rational_quality_manager Rational Quality Manager Rational Collaborative Lifecycle Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.60%

||

7 Day CHG~0.00%

Published-03 Jul, 2018 | 19:00

Updated-16 Sep, 2024 | 20:42

IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124758.

Vendor-IBM Corporation

Product-rational_collaborative_lifecycle_management rational_quality_manager Rational Quality Manager Rational Collaborative Lifecycle Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.20% / 41.59%

||

7 Day CHG~0.00%

Published-24 Jul, 2017 | 21:00

Updated-13 May, 2026 | 00:24

IBM Rational Software Architect Design Manager 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124580.

Vendor-IBM Corporation

Product-rational_software_architect_design_manager Rational Rhapsody Design Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.60%

||

7 Day CHG~0.00%

Published-03 Jul, 2018 | 19:00

Updated-16 Sep, 2024 | 23:26

IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force 124630.

Vendor-IBM Corporation

Product-rational_collaborative_lifecycle_management rational_quality_manager Rational Quality Manager Rational Collaborative Lifecycle Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.20% / 41.92%

||

7 Day CHG~0.00%

Published-24 Jul, 2017 | 21:00

Updated-13 May, 2026 | 00:24

IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-rhapsody_design_manager Rational Rhapsody Design Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.48%

||

7 Day CHG~0.00%

Published-13 Feb, 2017 | 22:00

Updated-13 May, 2026 | 00:24

IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997743

Vendor-IBM Corporation

Product-websphere_application_server WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.41%

||

7 Day CHG~0.00%

Published-26 Sep, 2017 | 17:00

Updated-13 May, 2026 | 00:24

IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127478.

Vendor-IBM Corporation

Product-business_process_manager Business Process Manager Advanced

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.20% / 41.92%

||

7 Day CHG~0.00%

Published-08 Feb, 2017 | 19:00

Updated-13 May, 2026 | 00:24

IBM Rational DOORS Next Generation 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-rational_requirements_composer rational_doors_next_generation Rational DOORS Next Generation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.23% / 45.39%

||

7 Day CHG~0.00%

Published-20 Mar, 2017 | 16:00

Updated-13 May, 2026 | 00:24

IBM Content Navigator 2.0.3 and 3.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999736.

Vendor-IBM Corporation

Product-content_navigator Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.26% / 49.26%

||

7 Day CHG~0.00%

Published-22 May, 2017 | 20:00

Updated-13 May, 2026 | 00:24

IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125732.

Vendor-IBM Corporation

Product-tivoli_federated_identity_manager Tivoli Federated Identity Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.34%

||

7 Day CHG~0.00%

Published-07 Sep, 2018 | 16:00

Updated-17 Sep, 2024 | 03:34

IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121152.

Vendor-IBM Corporation

Product-campaign Campaign

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.19% / 40.31%

||

7 Day CHG~0.00%

Published-20 Feb, 2013 | 11:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database (CCMDB) 7.1 and 7.2, and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to a display name.

Vendor-n/a IBM Corporation

Product-maximo_service_desk maximo_asset_management_essentials tivoli_service_request_manager maximo_asset_management change_and_configuration_management_database tivoli_asset_management_for_it smartcloud_control_desk n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.32% / 55.27%

||

7 Day CHG~0.00%

Published-14 Nov, 2007 | 01:00

Updated-23 Apr, 2026 | 00:35

Cross-site scripting (XSS) vulnerability in IBM Tivoli Service Desk 6.2 allows remote authenticated users to inject arbitrary web script or HTML via the Description parameter in a Maximo change action.

Vendor-n/a IBM Corporation

Product-tivoli_service_desk n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.69%

||

7 Day CHG~0.00%

Published-05 Jul, 2017 | 17:00

Updated-13 May, 2026 | 00:24

IBM Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119762.

Vendor-IBM Corporation

Product-rational_team_concert rational_collaborative_lifecycle_management Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.41%

||

7 Day CHG~0.00%

Published-22 Jun, 2017 | 18:00

Updated-13 May, 2026 | 00:24

IBM RELM 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-rational_engineering_lifecycle_manager rational_collaborative_lifecycle_management Rational Engineering Lifecycle Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.20% / 41.59%

||

7 Day CHG~0.00%

Published-28 Aug, 2017 | 20:00

Updated-13 May, 2026 | 00:24

IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119761.

Vendor-IBM Corporation

Product-curam_social_program_management Cram Social Program Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.69%

||

7 Day CHG~0.00%

Published-05 Jul, 2017 | 17:00

Updated-13 May, 2026 | 00:24

IBM Team Concert 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119529.

Vendor-IBM Corporation

Product-rational_team_concert rational_collaborative_lifecycle_management Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.20% / 41.38%

||

7 Day CHG~0.00%

Published-23 Sep, 2021 | 18:05

Updated-17 Sep, 2024 | 00:30

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204279.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix jazz_for_service_management windows linux_kernel Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.17%

||

7 Day CHG~0.00%

Published-19 Oct, 2021 | 15:15

Updated-16 Sep, 2024 | 23:11

IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828.

Vendor-Red Hat, Inc.IBM Corporation

Product-openshift security_risk_manager_on_cp4s Cloud Pak for Security

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.34%

||

7 Day CHG~0.00%

Published-06 Oct, 2021 | 17:10

Updated-17 Sep, 2024 | 01:05

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205684.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.98%

||

7 Day CHG~0.00%

Published-20 Sep, 2021 | 16:45

Updated-16 Sep, 2024 | 20:36

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204346.

Vendor-IBM Corporation

Product-tivoli_netcool\/omnibus_webgui Tivoli Netcool/OMNIbus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.13% / 31.83%

||

7 Day CHG~0.00%

Published-06 Jul, 2018 | 14:00

Updated-17 Sep, 2024 | 00:42

IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 126231.

Vendor-IBM Corporation

Product-rational_collaborative_lifecycle_management rational_quality_manager Rational Quality Manager

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.17%

||

7 Day CHG~0.00%

Published-27 Oct, 2021 | 16:00

Updated-16 Sep, 2024 | 16:32

IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager rational_team_concert engineering_lifecycle_optimization rational_collaborative_lifecycle_management Rational DOORS Next Generation Engineering Workflow Management Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.20% / 41.38%

||

7 Day CHG~0.00%

Published-23 Sep, 2021 | 18:05

Updated-17 Sep, 2024 | 02:51

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204331.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel aix windows jazz_for_service_management Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.18% / 38.91%

||

7 Day CHG~0.00%

Published-12 Jul, 2021 | 16:05

Updated-16 Sep, 2024 | 20:51

IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204263.

Vendor-IBM Corporation

Product-tivoli_netcool\/omnibus_gui Tivoli Netcool/OMNIbus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.06%

||

7 Day CHG~0.00%

Published-02 Jun, 2021 | 20:40

Updated-16 Sep, 2024 | 20:36

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199408.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager engineering_test_management rational_quality_manager engineering_lifecycle_optimization_-_publishing removable_media_manager engineering_lifecycle_optimization_-_engineering_insights collaborative_lifecycle_management engineering_lifecycle_management Rational Quality Manager Rational DOORS Next Generation Rational Rhapsody Model Manager Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Engineering Test Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.34%

||

7 Day CHG~0.00%

Published-18 Oct, 2021 | 16:35

Updated-17 Sep, 2024 | 01:36

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 206581.

Vendor-IBM Corporation

Product-business_automation_workflow Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.10% / 27.58%

||

7 Day CHG~0.00%

Published-08 Nov, 2021 | 16:50

Updated-16 Sep, 2024 | 20:52

IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel security_guardium Security Guardium

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.20% / 41.38%

||

7 Day CHG~0.00%

Published-20 Sep, 2021 | 16:45

Updated-17 Sep, 2024 | 03:03

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204265.

Vendor-IBM Corporation

Product-tivoli_netcool\/omnibus_webgui Tivoli Netcool/OMNIbus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.06%

||

7 Day CHG~0.00%

Published-23 Sep, 2021 | 18:05

Updated-17 Sep, 2024 | 01:42

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207616.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel aix windows jazz_for_service_management Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.05% / 16.85%

||

7 Day CHG~0.00%

Published-18 Jan, 2022 | 16:50

Updated-16 Sep, 2024 | 19:56

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 206228.

Vendor-IBM Corporation

Product-cloud_pak_for_automation Cloud Pak for Automation

CWE ID-CWE-116

Improper Encoding or Escaping of Output

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 34.07%

||

7 Day CHG~0.00%

Published-01 Sep, 2021 | 16:20

Updated-17 Sep, 2024 | 01:46

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205528.

Vendor-IBM Corporation

Product-planning_analytics Planning Analytics Local

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')