CVE-2024-45094 | ByteOS Network

Vulnerability Details :

CVE-2024-45094

Assigner-ibm

Assigner Org ID-9a959283-ebb5-44b6-b705-dcc2bbced522

Published At-27 May, 2025 | 22:41

Updated At-26 Aug, 2025 | 15:03

IBM DS8900F and DS8A00 Hardware Management Console (HMC) cross-site scripting

IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:ibm

Assigner Org ID:9a959283-ebb5-44b6-b705-dcc2bbced522

Published At:27 May, 2025 | 22:41

Updated At:26 Aug, 2025 | 15:03

▼CVE Numbering Authority (CNA)

IBM DS8900F and DS8A00 Hardware Management Console (HMC) cross-site scripting

IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Products

Vendor

IBM Corporation

Product

Hardware Management Console

CPEs

cpe:2.3:o:ibm:ds8900f_firmware:89.33.45.0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8900f_firmware:89.33.52.0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8900f_firmware:89.40.83.0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8900f_firmware:89.41.25.0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8900f_firmware:89.42.18.0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8900f_firmware:10.0.245.0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8900f_firmware:10.1.3.0:*:*:*:*:*:*:*

Default Status

unaffected

Versions

Affected

DS8900F
DS8A00

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	5.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Version: 3.1

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Solutions

DS8A00 fixes are delivered in Microcode Bundle 10.2.35.0 R10.0 SP2 DS8900F fixes are delivered in Microcode Bundle 89.43.3.0 R9.4 SP3

References

Hyperlink	Resource
https://www.ibm.com/support/pages/node/7234276	vendor-advisory patch

Hyperlink: https://www.ibm.com/support/pages/node/7234276

Resource:

vendor-advisory

patch

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:psirt@us.ibm.com

Published At:27 May, 2025 | 23:15

Updated At:09 Jun, 2025 | 18:51

IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CPE Matches

IBM Corporation

>>hardware_management_console_r10.0_firmware>>10.0.245.0

cpe:2.3:o:ibm:hardware_management_console_r10.0_firmware:10.0.245.0:*:*:*:*:*:*:*

IBM Corporation

>>hardware_management_console_r10.0_firmware>>10.1.3.0

cpe:2.3:o:ibm:hardware_management_console_r10.0_firmware:10.1.3.0:*:*:*:*:*:*:*

IBM Corporation

>>hardware_management_console_r10.0>>-

cpe:2.3:h:ibm:hardware_management_console_r10.0:-:*:*:*:*:*:*:*

IBM Corporation

>>hardware_management_console_r9.4_firmware>>89.40.83.0

cpe:2.3:o:ibm:hardware_management_console_r9.4_firmware:89.40.83.0:*:*:*:*:*:*:*

IBM Corporation

>>hardware_management_console_r9.4_firmware>>89.41.25.0

cpe:2.3:o:ibm:hardware_management_console_r9.4_firmware:89.41.25.0:*:*:*:*:*:*:*

IBM Corporation

>>hardware_management_console_r9.4_firmware>>89.42.18.0

cpe:2.3:o:ibm:hardware_management_console_r9.4_firmware:89.42.18.0:*:*:*:*:*:*:*

IBM Corporation

>>hardware_management_console_r9.4>>-

cpe:2.3:h:ibm:hardware_management_console_r9.4:-:*:*:*:*:*:*:*

IBM Corporation

>>hardware_management_console_r9.3_firmware>>89.33.45.0

cpe:2.3:o:ibm:hardware_management_console_r9.3_firmware:89.33.45.0:*:*:*:*:*:*:*

IBM Corporation

>>hardware_management_console_r9.3_firmware>>89.33.52.0

cpe:2.3:o:ibm:hardware_management_console_r9.3_firmware:89.33.52.0:*:*:*:*:*:*:*

IBM Corporation

>>hardware_management_console_r9.3>>-

cpe:2.3:h:ibm:hardware_management_console_r9.3:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	psirt@us.ibm.com

CWE ID: CWE-79

Type: Primary

Source: psirt@us.ibm.com

References

Hyperlink	Source	Resource
https://www.ibm.com/support/pages/node/7234276	psirt@us.ibm.com	Vendor Advisory

Hyperlink: https://www.ibm.com/support/pages/node/7234276

Source: psirt@us.ibm.com

Resource:

Vendor Advisory

Similar CVEs

10042Records found

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.31% / 53.38%

||

7 Day CHG~0.00%

Published-17 May, 2018 | 21:00

Updated-16 Sep, 2024 | 20:27

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 140362.

Vendor-IBM Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 7.30%

||

7 Day CHG~0.00%

Published-08 Jul, 2025 | 14:51

Updated-24 Aug, 2025 | 11:31

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-aix sterling_b2b_integrator windows sterling_file_gateway linux_kernel Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 5.61%

||

7 Day CHG~0.00%

Published-15 Aug, 2025 | 19:19

Updated-18 Aug, 2025 | 20:16

IBM TS4500 cross-site scripting

IBM TS4500 1.11.0.0-D00, 1.11.0.1-C00, 1.11.0.2-C00, and 1.10.00-F00 web GUI is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-Storage TS4500 Library

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.04% / 9.75%

||

7 Day CHG~0.00%

Published-15 May, 2025 | 15:40

Updated-26 Aug, 2025 | 15:06

IBM Security Guardium cross-site scripting

IBM Security Guardium 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-security_guardium Security Guardium

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.02% / 4.67%

||

7 Day CHG-0.00%

Published-23 Jan, 2025 | 02:38

Updated-04 Mar, 2025 | 21:36

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator Standard Edition

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.07% / 21.30%

||

7 Day CHG~0.00%

Published-27 Mar, 2024 | 12:35

Updated-05 Mar, 2025 | 20:50

IBM QRadar cross-site scripting

IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275939.

Vendor-IBM Corporation

Product-qradar_security_information_and_event_manager QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 6.95%

||

7 Day CHG~0.00%

Published-01 Jul, 2025 | 01:00

Updated-24 Aug, 2025 | 11:34

IBM System Storage Virtualization Engine TS7700 cross-site scripting

IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-System Storage Virtualization Engine TS7700

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.05% / 14.66%

||

7 Day CHG~0.00%

Published-13 Apr, 2025 | 11:56

Updated-18 Jul, 2025 | 18:07

IBM Aspera Faspex 5 cross-site scripting

IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-aspera_faspex linux_kernel Aspera Faspex

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 7.30%

||

7 Day CHG~0.00%

Published-15 Jul, 2025 | 14:29

Updated-18 Aug, 2025 | 01:34

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 - 7.5.0 UP12 IF02 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel qradar_security_information_and_event_manager QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.10% / 28.23%

||

7 Day CHG~0.00%

Published-12 Apr, 2024 | 02:30

Updated-07 Mar, 2025 | 12:36

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 273338.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 5.93%

||

7 Day CHG~0.00%

Published-01 Aug, 2025 | 17:21

Updated-14 Aug, 2025 | 18:49

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-qradar_security_information_and_event_manager QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.04% / 12.41%

||

7 Day CHG~0.00%

Published-22 May, 2025 | 16:37

Updated-26 Aug, 2025 | 15:04

IBM Aspera Faspex HTML injection

IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel aspera_faspex Aspera Faspex

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.12% / 31.92%

||

7 Day CHG~0.00%

Published-14 Jul, 2022 | 16:15

Updated-25 Mar, 2025 | 14:21

IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213655.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-engineering_lifecycle_optimization_-_publishing engineering_lifecycle_optimization_publishing windows linux_kernel Engineering Lifecycle Optimization Publishing

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.08% / 24.53%

||

7 Day CHG~0.00%

Published-24 May, 2024 | 12:01

Updated-08 Jan, 2025 | 20:17

IBM Security Guardium cross-site scripting

IBM Security Guardium 11.4, 11.5, and 12.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 271525.

Vendor-IBM Corporation

Product-security_guardium Security Guardium

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.06% / 17.84%

||

7 Day CHG~0.00%

Published-20 Dec, 2023 | 01:48

Updated-02 Aug, 2024 | 21:16

IBM Security Guardium Key Lifecycle Manager cross-site scripting

IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 271522.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix security_guardium_key_lifecycle_manager windows linux_kernel Security Guardium Key Lifecycle Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.01% / 0.77%

||

7 Day CHG~0.00%

Published-27 Jan, 2025 | 01:45

Updated-18 Aug, 2025 | 18:01

IBM InfoSphere Master Data Management cross-site scripting

IBM InfoSphere Master Data Management 11.6, 12.0, and 14.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-infosphere_master_data_management InfoSphere Master Data Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 5.61%

||

7 Day CHG~0.00%

Published-19 Aug, 2025 | 19:03

Updated-20 Aug, 2025 | 14:40

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator 6.2.1.0 and IBM Sterling File Gateway 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 33.99%

||

7 Day CHG~0.00%

Published-15 Mar, 2024 | 14:45

Updated-02 Aug, 2024 | 20:37

IBM Secure Proxy cross-site scripting

IBM Sterling Secure Proxy 6.0.3 and 6.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 269692.

Vendor-IBM Corporation

Product-sterling_secure_proxy Secure Proxy

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.26%

||

7 Day CHG~0.00%

Published-02 Jun, 2021 | 20:40

Updated-17 Sep, 2024 | 02:42

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199406.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager engineering_test_management rational_quality_manager engineering_lifecycle_optimization_-_publishing removable_media_manager engineering_lifecycle_optimization_-_engineering_insights collaborative_lifecycle_management engineering_lifecycle_management Rational Quality Manager Rational DOORS Next Generation Rational Rhapsody Model Manager Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Engineering Test Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.04% / 12.95%

||

7 Day CHG+0.01%

Published-25 Apr, 2025 | 11:07

Updated-28 Aug, 2025 | 15:03

IBM Maximo Asset Management cross-site scripting

IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-maximo_asset_management Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.22% / 44.99%

||

7 Day CHG~0.00%

Published-24 Feb, 2024 | 15:40

Updated-13 Feb, 2025 | 17:13

IBM Cognos Analytics cross-site scripting

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 267451.

Vendor-NetApp, Inc.IBM Corporation

Product-cognos_analytics oncommand_insight Cognos Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.28% / 50.75%

||

7 Day CHG~0.00%

Published-20 Aug, 2019 | 19:30

Updated-16 Sep, 2024 | 20:17

IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158146.

Vendor-IBM Corporation

Product-cloud_private Cloud Private

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.68%

||

7 Day CHG~0.00%

Published-24 Oct, 2019 | 12:00

Updated-17 Sep, 2024 | 02:27

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164070.

Vendor-IBM Corporation

Product-maximo_for_transportation maximo_for_life_sciences tivoli_integration_composer maximo_asset_management maximo_for_oil_and_gas maximo_for_utilities maximo_for_nuclear_power maximo_for_aviation smartcloud_control_desk Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.07% / 22.86%

||

7 Day CHG~0.00%

Published-01 Dec, 2023 | 20:52

Updated-02 Aug, 2024 | 19:16

IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265504.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.24%

||

7 Day CHG~0.00%

Published-25 Apr, 2019 | 14:36

Updated-16 Sep, 2024 | 20:06

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157111.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 7.30%

||

7 Day CHG~0.00%

Published-08 Jul, 2025 | 14:59

Updated-24 Aug, 2025 | 11:22

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-aix sterling_b2b_integrator windows sterling_file_gateway linux_kernel Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.06% / 18.52%

||

7 Day CHG~0.00%

Published-02 Nov, 2023 | 23:44

Updated-05 Sep, 2024 | 14:34

IBM CICS TX cross-site scripting

IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 266059.

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc

Product-txseries_for_multiplatforms linux_kernel cics_tx hp-ux windows aix CICS TX Advanced CICS TX Standard TXSeries for Multiplatforms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.10% / 27.82%

||

7 Day CHG~0.00%

Published-27 Jun, 2024 | 18:00

Updated-02 Aug, 2024 | 19:16

IBM Sterling B2B Integrator Standard Edition cross-site scripting

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.2.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265511.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator Standard Edition

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.23% / 45.58%

||

7 Day CHG~0.00%

Published-05 Mar, 2019 | 18:00

Updated-16 Sep, 2024 | 20:31

IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 155905.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.29% / 51.75%

||

7 Day CHG~0.00%

Published-25 Sep, 2019 | 20:05

Updated-16 Sep, 2024 | 16:42

IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 166721.

Vendor-IBM Corporation

Product-content_navigator Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.23% / 45.58%

||

7 Day CHG~0.00%

Published-05 Mar, 2019 | 18:00

Updated-17 Sep, 2024 | 02:52

IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155906.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.92%

||

7 Day CHG~0.00%

Published-09 Nov, 2019 | 01:41

Updated-17 Sep, 2024 | 01:15

IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163779.

Vendor-IBM Corporation

Product-qradar_security_information_and_event_manager QRadar

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.23% / 45.58%

||

7 Day CHG~0.00%

Published-19 Jun, 2019 | 13:30

Updated-16 Sep, 2024 | 23:00

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 160949.

Vendor-IBM Corporation

Product-maximo_for_transportation maximo_for_life_sciences control_desk tivoli_integration_composer maximo_asset_management maximo_for_oil_and_gas maximo_for_utilities maximo_for_nuclear_power maximo_for_aviation smartcloud_control_desk Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.24%

||

7 Day CHG~0.00%

Published-07 Jun, 2019 | 14:40

Updated-17 Sep, 2024 | 02:42

IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157015.

Vendor-IBM Corporation

Product-intelligent_operations_center_for_emergency_management water_operations_for_waternamics intelligent_operations_center Intelligent Operations Center

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.30% / 52.81%

||

7 Day CHG~0.00%

Published-31 May, 2021 | 15:10

Updated-17 Sep, 2024 | 03:28

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170964.

Vendor-IBM Corporation NetApp, Inc.

Product-cognos_analytics oncommand_insight Cognos Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.19% / 40.55%

||

7 Day CHG~0.00%

Published-11 Dec, 2019 | 14:25

Updated-16 Sep, 2024 | 23:01

IBM Spectrum Scale 4.2 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171247.

Vendor-IBM Corporation

Product-spectrum_scale Spectrum Scale

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.04% / 9.56%

||

7 Day CHG~0.00%

Published-01 Jun, 2025 | 11:35

Updated-26 Aug, 2025 | 14:55

IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-planning_analytics_local Planning Analytics Local

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 6.50%

||

7 Day CHG~0.00%

Published-23 Jan, 2025 | 17:19

Updated-15 Aug, 2025 | 12:46

IBM Tivoli Application Dependency Discovery Manager cross-site scripting

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-Linux Kernel Organization, Inc Microsoft Corporation IBM Corporation

Product-linux_kernel tivoli_application_dependency_discovery_manager windows aix Tivoli Application Dependency Discovery Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.68%

||

7 Day CHG~0.00%

Published-20 May, 2019 | 17:25

Updated-17 Sep, 2024 | 03:54

IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155885.

Vendor-IBM Corporation

Product-bigfix_platform BigFix Platform

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.24%

||

7 Day CHG~0.00%

Published-14 Jun, 2019 | 14:45

Updated-17 Sep, 2024 | 00:46

IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162264.

Vendor-IBM Corporation

Product-connections Connections

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.06% / 19.43%

||

7 Day CHG~0.00%

Published-26 Aug, 2020 | 19:00

Updated-16 Sep, 2024 | 16:17

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171828.

Vendor-IBM Corporation

Product-guardium_data_encryption guardium_for_cloud_key_management Security Guardium Data Encryption

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.28% / 50.75%

||

7 Day CHG~0.00%

Published-01 Oct, 2019 | 14:30

Updated-16 Sep, 2024 | 19:56

IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164116.

Vendor-IBM Corporation

Product-jazz_reporting_service Jazz Reporting Service

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.24%

||

7 Day CHG~0.00%

Published-25 Apr, 2019 | 14:36

Updated-16 Sep, 2024 | 22:51

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157108.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 40.14%

||

7 Day CHG~0.00%

Published-08 Apr, 2020 | 14:05

Updated-17 Sep, 2024 | 00:56

IBM DOORS Next Generation (DNG/RRC) 6.0.2. 6.0.6, and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172885.

Vendor-IBM Corporation

Product-rational_doors_next_generation doors_next_generation Rational DOORS Next Generation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.28% / 50.75%

||

7 Day CHG~0.00%

Published-27 Jun, 2019 | 13:45

Updated-16 Sep, 2024 | 18:03

IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157383.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager rational_quality_manager rational_team_concert rational_collaborative_lifecycle_management rational_rhapsody_design_manager rational_software_architect_design_manager Rational Collaborative Lifecycle Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.26%

||

7 Day CHG~0.00%

Published-01 Jul, 2019 | 15:05

Updated-17 Sep, 2024 | 01:06

A Cross-Frame Scripting vulnerability in IBM InfoSphere Information Server 11.3, 11.5, and 11.7 can allow an attacker to load the vulnerable application inside an HTML iframe tag on a malicious page. IBM X-Force ID: 159419.

Vendor-IBM Corporation

Product-infosphere_information_server_on_cloud infosphere_information_governance_catalog infosphere_information_server InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.26%

||

7 Day CHG~0.00%

Published-17 Jun, 2019 | 15:10

Updated-16 Sep, 2024 | 20:43

IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158332.

Vendor-IBM Corporation

Product-cognos_controller Cognos Controller

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.24%

||

7 Day CHG~0.00%

Published-08 Apr, 2020 | 14:05

Updated-17 Sep, 2024 | 03:08

IBM DOORS Next Generation (DNG/RRC) 6.0.2. 6.0.6, and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172808.

Vendor-IBM Corporation

Product-rational_doors_next_generation doors_next_generation Rational DOORS Next Generation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.82%

||

7 Day CHG~0.00%

Published-16 Jul, 2020 | 15:05

Updated-17 Sep, 2024 | 00:40

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173174.

Vendor-IBM Corporation

Product-rational_doors_next_generation engineering_test_management rational_quality_manager rational_team_concert engineering_lifecycle_manager engineering_workflow_management reference_data_management doors_next collaborative_lifecycle_management rhapsody_design_manager Rational Quality Manager Rational DOORS Next Generation Engineering Workflow Management Rational Rhapsody Design Manager Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.68%

||

7 Day CHG~0.00%

Published-30 Dec, 2019 | 15:35

Updated-17 Sep, 2024 | 00:06

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168924.

Vendor-IBM Corporation

Product-cognos_analytics Cognos Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')