CVE-2025-2793 | ByteOS Network

Vulnerability Details :

CVE-2025-2793

Assigner-ibm

Assigner Org ID-9a959283-ebb5-44b6-b705-dcc2bbced522

Published At-08 Jul, 2025 | 14:59

Updated At-24 Aug, 2025 | 11:22

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:ibm

Assigner Org ID:9a959283-ebb5-44b6-b705-dcc2bbced522

Published At:08 Jul, 2025 | 14:59

Updated At:24 Aug, 2025 | 11:22

▼CVE Numbering Authority (CNA)

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Products

Vendor

IBM Corporation

Product

Sterling B2B Integrator

CPEs

cpe:2.3:a:ibm:sterling_b2b_integrator:6.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.4:*:*:*:*:*:*:*

Default Status

unaffected

Versions

Affected

From 6.0.0.0 through 6.1.2.6 (semver)
From 6.2.0.0 through 6.2.0.4 (semver)

Vendor

IBM Corporation

Product

Sterling File Gateway

CPEs

cpe:2.3:a:ibm:sterling_file_gateway:6.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_file_gateway:6.1.2.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_file_gateway:6.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_file_gateway:6.2.0.4:*:*:*:*:*:*:*

Default Status

unaffected

Versions

Affected

From 6.0.0.0 through 6.1.2.6 (semver)
From 6.2.0.0 through 6.2.0.4 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Solutions

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 - 6.1.2.6 IT47924 Apply B2Bi 6.1.2.7_1. 6.2.0.5 or 6.2.1.0 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 - 6.2.0.4 IT47924 Apply B2Bi 6.2.0.5 or 6.2.1.0

References

Hyperlink	Resource
https://www.ibm.com/support/pages/node/7239092	vendor-advisory patch

Hyperlink: https://www.ibm.com/support/pages/node/7239092

Resource:

vendor-advisory

patch

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:psirt@us.ibm.com

Published At:08 Jul, 2025 | 15:15

Updated At:02 Aug, 2025 | 01:23

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CPE Matches

IBM Corporation

>>sterling_b2b_integrator>>Versions from 6.0.0.0(inclusive) to 6.1.2.7_1(exclusive)

cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:standard:*:*:*

IBM Corporation

>>sterling_b2b_integrator>>Versions from 6.2(inclusive) to 6.2.0.5(exclusive)

cpe:2.3:a:ibm:sterling_b2b_integrator:*:*:*:*:standard:*:*:*

IBM Corporation

>>sterling_file_gateway>>Versions from 6.0.0.0(inclusive) to 6.1.2.7_1(exclusive)

cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:*

IBM Corporation

>>sterling_file_gateway>>Versions from 6.2.0.0(inclusive) to 6.2.0.5(exclusive)

cpe:2.3:a:ibm:sterling_file_gateway:*:*:*:*:*:*:*:*

IBM Corporation

>>aix>>-

cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*

Linux Kernel Organization, Inc

>>linux_kernel>>-

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Microsoft Corporation

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	psirt@us.ibm.com

CWE ID: CWE-79

Type: Primary

Source: psirt@us.ibm.com

References

Hyperlink	Source	Resource
https://www.ibm.com/support/pages/node/7239092	psirt@us.ibm.com	Vendor Advisory

Hyperlink: https://www.ibm.com/support/pages/node/7239092

Source: psirt@us.ibm.com

Resource:

Vendor Advisory

Similar CVEs

12084Records found

Matching Score-10

Assigner-Octopus Deploy

Matching Score-10

Assigner-Octopus Deploy

CVSS Score-4.1||MEDIUM

EPSS-0.26% / 16.64%

||

7 Day CHG~0.00%

Published-08 May, 2024 | 00:46

Updated-30 Jun, 2025 | 18:04

In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.

Vendor-Octopus Deploy Pty. Ltd.Linux Kernel Organization, Inc Microsoft Corporation

Product-windows linux_kernel octopus_server Octopus Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 11.33%

||

7 Day CHG~0.00%

Published-27 Jun, 2025 | 14:48

Updated-17 Aug, 2025 | 00:24

IBM Cloud Pak System HTML injection

IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Vendor-IBM Corporation

Product-cloud_pak_system Cloud Pak System

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.48% / 37.66%

||

7 Day CHG~0.00%

Published-06 Oct, 2021 | 17:10

Updated-16 Sep, 2024 | 16:24

IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 202268.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.50% / 38.62%

||

7 Day CHG~0.00%

Published-25 Jun, 2021 | 17:40

Updated-17 Sep, 2024 | 00:30

IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-security_verify Security Verify Privilege Vault

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.32% / 23.74%

||

7 Day CHG~0.00%

Published-23 Oct, 2023 | 17:40

Updated-11 Sep, 2024 | 14:17

IBM Sterling Partner Engagement Manager cross-site scripting

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 262174.

Vendor-IBM Corporation

Product-sterling_partner_engagement_manager Sterling Partner Engagement Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.48% / 37.75%

||

7 Day CHG~0.00%

Published-11 Apr, 2022 | 18:17

Updated-17 Sep, 2024 | 01:26

IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215306.

Vendor-IBM Corporation

Product-curam_social_program_management Curam Social Program Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.42% / 33.56%

||

7 Day CHG~0.00%

Published-16 Aug, 2022 | 18:45

Updated-16 Sep, 2024 | 18:38

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213965.

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Product-sterling_b2b_integrator solaris linux_kernel hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.38% / 29.42%

||

7 Day CHG~0.00%

Published-29 Aug, 2022 | 21:10

Updated-16 Sep, 2024 | 23:51

IBM Engineering Test Management 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 210671.

Vendor-IBM Corporation

Product-engineering_test_management rational_quality_manager Engineering Test Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-3||LOW

EPSS-0.45% / 35.44%

||

7 Day CHG~0.00%

Published-07 Jan, 2022 | 17:55

Updated-16 Sep, 2024 | 23:55

IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209563.

Vendor-IBM Corporation

Product-security_verify_access Security Verify Access

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.47% / 37.19%

||

7 Day CHG~0.00%

Published-14 Feb, 2022 | 17:30

Updated-16 Sep, 2024 | 18:49

IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215592.

Vendor-IBM Corporation

Product-cognos_analytics_mobile Cognos Analytics Mobile

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.48% / 37.66%

||

7 Day CHG~0.00%

Published-23 Sep, 2021 | 17:40

Updated-17 Sep, 2024 | 00:11

IBM Aspera Cloud is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208343.

Vendor-IBM Corporation

Product-aspera_on_cloud Aspera

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.44% / 34.92%

||

7 Day CHG~0.00%

Published-20 May, 2022 | 16:20

Updated-16 Sep, 2024 | 22:03

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214032.

Vendor-IBM Corporation

Product-jazz_team_server Jazz Team Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.46% / 36.48%

||

7 Day CHG~0.00%

Published-14 Mar, 2022 | 16:45

Updated-16 Sep, 2024 | 18:29

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214534.

Vendor-IBM Corporation

Product-spectrum_copy_data_management Spectrum Copy Data Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.48% / 37.66%

||

7 Day CHG~0.00%

Published-21 Dec, 2021 | 19:10

Updated-17 Sep, 2024 | 01:12

IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212357.

Vendor-IBM Corporation

Product-cloud_pak_for_automation workflow_process_service Cloud Pak for Automation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.69% / 47.83%

||

7 Day CHG~0.00%

Published-21 Dec, 2021 | 19:10

Updated-17 Sep, 2024 | 00:26

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512.

Vendor-IBM Corporation

Product-workflow_process_service business_automation_workflow business_process_manager Cloud Pak for Automation Business Process Manager Standard

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.42% / 33.63%

||

7 Day CHG+0.02%

Published-14 Jul, 2022 | 16:15

Updated-25 Mar, 2025 | 14:21

IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213655.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-engineering_lifecycle_optimization_-_publishing engineering_lifecycle_optimization_publishing windows linux_kernel Engineering Lifecycle Optimization Publishing

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.52% / 39.78%

||

7 Day CHG~0.00%

Published-15 Nov, 2021 | 15:35

Updated-16 Sep, 2024 | 20:52

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212791.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel security_guardium_key_lifecycle_manager windows security_key_lifecycle_manager aix Security Key Lifecycle Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.36% / 27.96%

||

7 Day CHG~0.00%

Published-07 Jul, 2023 | 18:12

Updated-24 Oct, 2024 | 14:25

IBM Cloud Object Storage System cross-site scripting

IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213650.

Vendor-IBM Corporation

Product-cloud_object_storage_system Cloud Object Storage System

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.69% / 47.83%

||

7 Day CHG~0.00%

Published-03 Dec, 2021 | 17:00

Updated-16 Sep, 2024 | 18:28

IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209706.

Vendor-IBM Corporation NetApp, Inc.

Product-cognos_analytics oncommand_insight Cognos Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.48% / 37.66%

||

7 Day CHG~0.00%

Published-17 Dec, 2021 | 17:05

Updated-16 Sep, 2024 | 19:25

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209165.

Vendor-IBM Corporation

Product-business_automation_workflow business_process_manager Business Process Manager Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.64% / 45.91%

||

7 Day CHG~0.00%

Published-22 Apr, 2022 | 16:30

Updated-16 Sep, 2024 | 20:42

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240.

Vendor-IBM Corporation NetApp, Inc.

Product-cognos_analytics oncommand_insight Cognos Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.90% / 55.10%

||

7 Day CHG~0.00%

Published-22 Apr, 2022 | 16:30

Updated-16 Sep, 2024 | 19:57

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 209691.

Vendor-IBM Corporation NetApp, Inc.

Product-cognos_analytics oncommand_insight Cognos Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.45% / 35.62%

||

7 Day CHG+0.01%

Published-28 Apr, 2022 | 16:10

Updated-16 Sep, 2024 | 20:57

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211408.

Vendor-IBM Corporation

Product-infosphere_information_server InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.95% / 56.73%

||

7 Day CHG~0.00%

Published-14 May, 2024 | 16:57

Updated-03 May, 2025 | 00:06

Azure Migrate Cross-Site Scripting Vulnerability

Azure Migrate Cross-Site Scripting Vulnerability

Vendor-Microsoft Corporation

Product-azure_migrate Azure Migrate

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.95% / 56.66%

||

7 Day CHG~0.00%

Published-12 Aug, 2021 | 18:12

Updated-04 Aug, 2024 | 01:09

Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

Vendor-Microsoft Corporation

Product-dynamics_365_business_central dynamics_nav Dynamics 365 Business Central Spring 2019 Update Microsoft Dynamics NAV 2017 Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.15 Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.9 Microsoft Dynamics NAV 2018

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.30% / 21.90%

||

7 Day CHG+0.02%

Published-15 Jul, 2024 | 02:05

Updated-02 Aug, 2024 | 04:26

IBM Datacap Navigator cross-site scripting

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 296002.

Vendor-IBM Corporation

Product-datacap datacap_navigator Datacap Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-1.58% / 72.43%

||

7 Day CHG~0.00%

Published-16 May, 2019 | 18:24

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.

Vendor-Microsoft Corporation

Product-sharepoint_foundation Microsoft SharePoint Foundation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-1.57% / 72.21%

||

7 Day CHG~0.00%

Published-09 Apr, 2019 | 20:16

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0830.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-1.57% / 72.21%

||

7 Day CHG~0.00%

Published-09 Apr, 2019 | 20:16

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0831.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.51% / 39.44%

||

7 Day CHG+0.11%

Published-09 Jun, 2026 | 17:05

Updated-23 Jun, 2026 | 17:44

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Vendor-Microsoft Corporation

Product-sharepoint_server Microsoft SharePoint Server 2019 Microsoft SharePoint Server Subscription Edition Microsoft SharePoint Enterprise Server 2016

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Cyber Security Works Pvt. Ltd.

Matching Score-10

Assigner-Cyber Security Works Pvt. Ltd.

CVSS Score-5.4||MEDIUM

EPSS-1.51% / 71.20%

||

7 Day CHG~0.00%

Published-19 Nov, 2021 | 15:52

Updated-04 Aug, 2024 | 00:05

There is a Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3. The XSS payload executes whenever the user changes the clarity configuration in Microsoft Clarity version 0.3. The payload is stored on the configuring project Id page.

Vendor-n/a Microsoft Corporation

Product-clarity Microsoft Clarity

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.51% / 39.17%

||

7 Day CHG+0.11%

Published-09 Jun, 2026 | 17:05

Updated-23 Jun, 2026 | 17:45

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Vendor-Microsoft Corporation

Product-sharepoint_server Microsoft SharePoint Server 2019 Microsoft SharePoint Server Subscription Edition Microsoft SharePoint Enterprise Server 2016

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.51% / 39.17%

||

7 Day CHG+0.11%

Published-09 Jun, 2026 | 17:05

Updated-23 Jun, 2026 | 17:44

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Vendor-Microsoft Corporation

Product-sharepoint_server Microsoft SharePoint Server 2019 Microsoft SharePoint Server Subscription Edition Microsoft SharePoint Enterprise Server 2016

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.51% / 39.17%

||

7 Day CHG+0.11%

Published-09 Jun, 2026 | 17:05

Updated-23 Jun, 2026 | 17:44

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Vendor-Microsoft Corporation

Product-sharepoint_server Microsoft SharePoint Server 2019 Microsoft SharePoint Server Subscription Edition Microsoft SharePoint Enterprise Server 2016

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-7.6||HIGH

EPSS-0.70% / 48.27%

||

7 Day CHG~0.00%

Published-12 Sep, 2023 | 16:58

Updated-30 Oct, 2025 | 18:18

Dynamics Finance and Operations Cross-site Scripting Vulnerability

Dynamics Finance and Operations Cross-site Scripting Vulnerability

Vendor-Microsoft Corporation

Product-dynamics_365 Dynamics 365 for Finance and Operations

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.25% / 15.72%

||

7 Day CHG~0.00%

Published-28 May, 2024 | 12:06

Updated-14 Jan, 2025 | 20:22

IBM Aspera Faspex cross-site scripting

IBM Aspera Faspex 5.0.0 through 5.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260139.

Vendor-IBM Corporation

Product-aspera_faspex Aspera Faspex

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Microsoft Corporation

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-1.64% / 73.30%

||

7 Day CHG~0.00%

Published-08 Jan, 2019 | 21:00

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2019-0557, CVE-2019-0558.

Vendor-Microsoft Corporation

Product-sharepoint_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.48% / 37.41%

||

7 Day CHG~0.00%

Published-08 Nov, 2021 | 16:50

Updated-16 Sep, 2024 | 20:52

IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel security_guardium Security Guardium

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.48% / 37.66%

||

7 Day CHG~0.00%

Published-27 Oct, 2021 | 16:00

Updated-17 Sep, 2024 | 00:45

IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199482.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager rational_team_concert engineering_lifecycle_optimization rational_collaborative_lifecycle_management engineering_workflow_management Rational DOORS Next Generation Engineering Workflow Management Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.52% / 40.17%

||

7 Day CHG~0.00%

Published-20 Sep, 2021 | 16:45

Updated-17 Sep, 2024 | 02:37

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204264.

Vendor-IBM Corporation

Product-tivoli_netcool\/omnibus_webgui Tivoli Netcool/OMNIbus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.48% / 37.66%

||

7 Day CHG~0.00%

Published-23 Sep, 2021 | 18:05

Updated-17 Sep, 2024 | 02:51

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204331.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel aix windows jazz_for_service_management Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.52% / 39.78%

||

7 Day CHG~0.00%

Published-01 Sep, 2021 | 16:20

Updated-17 Sep, 2024 | 01:46

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205528.

Vendor-IBM Corporation

Product-planning_analytics Planning Analytics Local

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.88% / 54.31%

||

7 Day CHG~0.00%

Published-28 Jun, 2021 | 15:55

Updated-16 Sep, 2024 | 16:52

IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203029.

Vendor-IBM Corporation

Product-cloud_pak_for_automation business_automation_workflow Cloud Pak for Automation Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.50% / 38.62%

||

7 Day CHG~0.00%

Published-27 Apr, 2021 | 16:32

Updated-16 Sep, 2024 | 22:55

IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199400.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-spectrum_scale linux_kernel Spectrum Scale

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.48% / 37.66%

||

7 Day CHG~0.00%

Published-23 Sep, 2021 | 18:05

Updated-16 Sep, 2024 | 20:06

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204340.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel aix windows jazz_for_service_management Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.50% / 38.62%

||

7 Day CHG~0.00%

Published-12 Jul, 2021 | 16:05

Updated-16 Sep, 2024 | 20:03

IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204349.

Vendor-IBM Corporation

Product-tivoli_netcool\/omnibus_gui Tivoli Netcool/OMNIbus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.42% / 33.63%

||

7 Day CHG+0.02%

Published-18 Jul, 2022 | 17:00

Updated-16 Sep, 2024 | 23:31

IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203440.

Vendor-IBM Corporation

Product-engineering_requirements_quality_assistant_on-premises Engineering Requirements Quality Assistant On-Premises

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.48% / 37.66%

||

7 Day CHG~0.00%

Published-23 Sep, 2021 | 18:05

Updated-17 Sep, 2024 | 00:30

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204279.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix jazz_for_service_management windows linux_kernel Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.48% / 37.67%

||

7 Day CHG~0.00%

Published-14 Sep, 2021 | 13:25

Updated-17 Sep, 2024 | 03:49

IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 205045.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel linux_on_ibm_z financial_transaction_manager z\/os aix Financial Transaction Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.50% / 38.62%

||

7 Day CHG+0.02%

Published-27 Aug, 2021 | 15:20

Updated-16 Sep, 2024 | 22:30

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 201694.

Vendor-IBM Corporation

Product-maximo_application_suite maximo_asset_management Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')