CVE-2025-36138 | ByteOS Network

Vulnerability Details :

CVE-2025-36138

Assigner-ibm

Assigner Org ID-9a959283-ebb5-44b6-b705-dcc2bbced522

Published At-27 Oct, 2025 | 18:47

Updated At-27 Oct, 2025 | 19:27

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:ibm

Assigner Org ID:9a959283-ebb5-44b6-b705-dcc2bbced522

Published At:27 Oct, 2025 | 18:47

Updated At:27 Oct, 2025 | 19:27

▼CVE Numbering Authority (CNA)

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Products

Vendor

IBM Corporation

Product

Default Status

unaffected

Versions

Affected

From 7.5.0 through 7.5.0 Update Pack 13 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	6.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Credits

finder

Fahimhusain Raydurg

References

Hyperlink	Resource
https://www.ibm.com/support/pages/node/7249278	vendor-advisory patch

Hyperlink: https://www.ibm.com/support/pages/node/7249278

Resource:

vendor-advisory

patch

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:psirt@us.ibm.com

Published At:27 Oct, 2025 | 19:16

Updated At:15 Dec, 2025 | 18:28

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CPE Matches

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_1:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_01:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_02:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_2:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_3:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_4:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_5:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_6:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_7:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_8:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_9:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	psirt@us.ibm.com

CWE ID: CWE-79

Type: Secondary

Source: psirt@us.ibm.com

References

Hyperlink	Source	Resource
https://www.ibm.com/support/pages/node/7249278	psirt@us.ibm.com	Vendor Advisory

Hyperlink: https://www.ibm.com/support/pages/node/7249278

Source: psirt@us.ibm.com

Resource:

Vendor Advisory

Similar CVEs

12866Records found

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.36% / 58.03%

||

7 Day CHG+0.22%

Published-29 Apr, 2023 | 02:42

Updated-30 Jan, 2025 | 17:02

IBM Financial Transaction Manager for SWIFT Services cross-site scripting

IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 239707.

Vendor-IBM Corporation

Product-financial_transaction_manager_for_multiplatform Financial Transaction Manager for SWIFT Services

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.20% / 41.90%

||

7 Day CHG+0.03%

Published-05 May, 2023 | 18:20

Updated-29 Jan, 2025 | 16:15

IBM Maximo Asset Management cross-site scripting

IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 239436.

Vendor-IBM Corporation

Product-maximo_asset_management Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.30% / 53.06%

||

7 Day CHG~0.00%

Published-14 Apr, 2025 | 20:44

Updated-15 Aug, 2025 | 15:20

IBM Aspera Console cross-site scripting

IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-aspera_console windows linux_kernel Aspera Console

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.55% / 67.96%

||

7 Day CHG~0.00%

Published-07 Apr, 2023 | 13:26

Updated-10 Feb, 2025 | 15:21

IBM TRIRIGA Application Platform cross-site scripting

IBM TRIRIGA Application Platform 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 241036.

Vendor-IBM Corporation

Product-tririga_application_platform TRIRIGA Application Platform

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.36%

||

7 Day CHG~0.00%

Published-08 Jan, 2021 | 14:45

Updated-16 Sep, 2024 | 17:58

IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186235.

Vendor-IBM Corporation

Product-engineering_requirements_quality_assistant_on-premises Engineering Requirements Quality Assistant

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.26%

||

7 Day CHG~0.00%

Published-30 Aug, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128171.

Vendor-IBM Corporation

Product-emptoris_spend_analysis Emptoris Spend Analysis

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.10% / 27.35%

||

7 Day CHG~0.00%

Published-30 May, 2024 | 11:36

Updated-08 Jan, 2025 | 17:25

IBM Aspera Console cross-site scripting

IBM Aspera Console 3.4.0 through 3.4.2 PL5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 238645.

Vendor-IBM Corporation

Product-aspera_console Aspera Console

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.36% / 58.03%

||

7 Day CHG~0.00%

Published-22 Feb, 2023 | 17:39

Updated-03 Aug, 2024 | 13:32

IBM Sterling B2B Integrator Standard Edition cross-site scripting

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 238683.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-sterling_b2b_integrator aix windows linux_kernel Sterling B2B Integrator Standard Edition

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.4||MEDIUM

EPSS-0.55% / 67.96%

||

7 Day CHG~0.00%

Published-09 Dec, 2022 | 18:09

Updated-29 Oct, 2025 | 17:44

IBM Cloud Transformation Advisor cross-site scripting

IBM Cloud Transformation Advisor 2.0.1 through 3.3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 237214.

Vendor-IBM Corporation

Product-transformation_advisor Cloud Transformation Advisor

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.11%

||

7 Day CHG~0.00%

Published-11 Jun, 2020 | 12:10

Updated-16 Sep, 2024 | 17:53

IBM Workload Scheduler 9.3.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179160.

Vendor-IBM Corporation

Product-workload_scheduler Workload Scheduler

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.20%

||

7 Day CHG~0.00%

Published-04 Aug, 2021 | 14:00

Updated-16 Sep, 2024 | 18:24

IBM API Connect 5.0.0.0 through 5.0.8.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187370.

Vendor-IBM Corporation

Product-api_connect API Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.90%

||

7 Day CHG~0.00%

Published-02 Jun, 2021 | 20:40

Updated-17 Sep, 2024 | 02:15

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 193737.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager engineering_test_management rational_quality_manager engineering_lifecycle_optimization_-_publishing removable_media_manager engineering_lifecycle_optimization_-_engineering_insights collaborative_lifecycle_management engineering_lifecycle_management Rational Quality Manager Rational DOORS Next Generation Rational Rhapsody Model Manager Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Engineering Test Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.66% / 71.02%

||

7 Day CHG~0.00%

Published-11 Nov, 2022 | 18:21

Updated-01 May, 2025 | 13:40

IBM WebSphere Application Server cross-site scripting

IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236588.

Vendor-Linux Kernel Organization, Inc Microsoft Corporation Oracle Corporation HP Inc.IBM Corporation

Product-solaris linux_kernel websphere_application_server i hp-ux windows z\/os aix WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 4.92%

||

7 Day CHG~0.00%

Published-01 Apr, 2026 | 20:34

Updated-07 Apr, 2026 | 16:34

Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 allows certificate listings retrieved via a browser session to return a JSON payload while incorrectly specifying the response Content-Type as text/html. Because the content is delivered with an HTML MIME type, browsers may interpret the JSON data as executable script under certain conditions. This creates an opportunity for JavaScript injection, potentially leading to cross-site scripting (XSS).

Vendor-IBM Corporation

Product-verify_identity_access_container verify_identity_access security_verify_access_container security_verify_access Verify Identity Access Security Verify Access Container Security Verify Access Verify Identity Access Container

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.28% / 51.36%

||

7 Day CHG~0.00%

Published-17 Nov, 2022 | 16:48

Updated-29 Apr, 2025 | 13:46

Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233978.

Vendor-IBM Corporation

Product-business_automation_workflow Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.11%

||

7 Day CHG~0.00%

Published-26 Jun, 2020 | 13:45

Updated-17 Sep, 2024 | 03:43

IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 175121.

Vendor-IBM Corporation

Product-maximo_asset_management Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.11%

||

7 Day CHG~0.00%

Published-08 Jan, 2021 | 20:40

Updated-17 Sep, 2024 | 00:25

IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188127.

Vendor-IBM Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 33.91%

||

7 Day CHG~0.00%

Published-05 Apr, 2021 | 16:20

Updated-17 Sep, 2024 | 03:38

IBM Edge 4.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 189441.

Vendor-IBM Corporation

Product-edge_application_manager Edge

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.53% / 67.26%

||

7 Day CHG+0.15%

Published-11 Nov, 2022 | 18:44

Updated-01 May, 2025 | 13:39

IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233663.

Vendor-Linux Kernel Organization, Inc IBM Corporation

Product-cloud_pak_for_security linux_kernel Cloud Pak for Security

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.31% / 54.47%

||

7 Day CHG~0.00%

Published-02 Jun, 2020 | 13:45

Updated-16 Sep, 2024 | 23:15

IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 180761.

Vendor-IBM Corporation

Product-planning_analytics_local Planning Analytics Local

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.38% / 59.26%

||

7 Day CHG~0.00%

Published-26 Aug, 2022 | 17:25

Updated-16 Sep, 2024 | 19:50

IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231116.

Vendor-IBM Corporation

Product-maximo_asset_management Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.17% / 38.39%

||

7 Day CHG~0.00%

Published-17 Jun, 2019 | 15:10

Updated-16 Sep, 2024 | 20:43

IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158332.

Vendor-IBM Corporation

Product-cognos_controller Cognos Controller

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.53% / 67.26%

||

7 Day CHG~0.00%

Published-23 Sep, 2022 | 17:35

Updated-22 May, 2025 | 19:15

IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231380.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-windows linux_kernel jazz_for_service_management aix Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.65% / 70.83%

||

7 Day CHG~0.00%

Published-02 Mar, 2023 | 20:14

Updated-05 Mar, 2025 | 19:53

IBM Maximo Asset Management cross-site scripting

IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 230958.

Vendor-IBM Corporation

Product-maximo_application_suite maximo_asset_management Maximo Asset Management Maximo Application Suite

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.33% / 55.88%

||

7 Day CHG~0.00%

Published-28 Sep, 2022 | 15:55

Updated-20 May, 2025 | 21:15

IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231381.

Vendor-IBM Corporation

Product-jazz_for_service_management Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.65% / 70.83%

||

7 Day CHG~0.00%

Published-14 Nov, 2022 | 19:10

Updated-29 Apr, 2025 | 19:32

IBM CICS TX cross-site scripting

IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229459.

Vendor-IBM Corporation

Product-cics_tx CICS TX

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.23%

||

7 Day CHG~0.00%

Published-31 Jul, 2022 | 16:05

Updated-16 Sep, 2024 | 20:16

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228358.

Vendor-IBM Corporation

Product-datapower_gateway DataPower Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.10% / 26.76%

||

7 Day CHG~0.00%

Published-27 Jan, 2025 | 16:06

Updated-06 Nov, 2025 | 22:01

IBM Sterling File Gateway cross-site scripting

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_file_gateway Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.10% / 27.17%

||

7 Day CHG~0.00%

Published-10 Jun, 2022 | 16:00

Updated-16 Sep, 2024 | 17:33

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using some fields of the form in the portal UI to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 227364.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-spectrum_copy_data_management linux_kernel Spectrum Copy Data Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 5.79%

||

7 Day CHG~0.00%

Published-07 Oct, 2025 | 17:50

Updated-12 Dec, 2025 | 19:53

IBM Jazz Foundation cross-site scripting

IBM Engineering Requirements Management DOORS Next (IBM Jazz Foundation 7.0.2 to 7.0.2 iFix034, 7.0.3 to 7.0.3 iFix016, and 7.1.0 to 7.1.0 iFix004) is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users on the host network to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-jazz_foundation Jazz Foundation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 8.97%

||

7 Day CHG~0.00%

Published-19 Mar, 2026 | 01:55

Updated-23 Mar, 2026 | 18:07

IBM QRadar SIEM Cross-Site Scripting

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality.

Vendor-Linux Kernel Organization, Inc IBM Corporation

Product-linux_kernel qradar_security_information_and_event_manager QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.01% / 1.29%

||

7 Day CHG~0.00%

Published-13 Mar, 2026 | 19:08

Updated-20 Mar, 2026 | 19:19

IBM Sterling B2B Integrator and IBM Sterling File Gateway Cross-Site Scripting

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_b2b_integrator sterling_file_gateway Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.22% / 44.72%

||

7 Day CHG~0.00%

Published-08 Sep, 2020 | 14:30

Updated-17 Sep, 2024 | 00:42

IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186841.

Vendor-IBM Corporation

Product-business_automation_workflow business_process_manager Business Process Manager Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.11%

||

7 Day CHG~0.00%

Published-08 Jan, 2021 | 14:45

Updated-16 Sep, 2024 | 22:55

IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186281.

Vendor-IBM Corporation

Product-engineering_requirements_quality_assistant_on-premises Engineering Requirements Quality Assistant

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.25% / 48.12%

||

7 Day CHG~0.00%

Published-04 Mar, 2021 | 19:05

Updated-16 Sep, 2024 | 18:34

IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190566.

Vendor-IBM Corporation

Product-rational_doors_next_generation global_configuration_management engineering_test_management rational_quality_manager rational_team_concert engineering_workflow_management doors_next engineering_lifecycle_management engineering_requirements_quality_assistant_on-premises Rational Quality Manager Rational DOORS Next Generation Engineering Workflow Management Engineering Lifecycle Optimization Engineering Test Management Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.36%

||

7 Day CHG~0.00%

Published-03 Mar, 2020 | 13:50

Updated-16 Sep, 2024 | 18:33

IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174909.

Vendor-IBM Corporation

Product-tivoli_netcool\/omnibus Tivoli Netcool/OMNIbus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.10% / 28.05%

||

7 Day CHG~0.00%

Published-07 Jan, 2021 | 17:40

Updated-17 Sep, 2024 | 01:00

IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190986.

Vendor-IBM Corporation

Product-emptoris_strategic_supply_management Emptoris Sourcing

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.85%

||

7 Day CHG~0.00%

Published-19 Jul, 2021 | 16:00

Updated-16 Sep, 2024 | 18:43

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 193738.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager rational_team_concert engineering_lifecycle_optimization rational_collaborative_lifecycle_management engineering_workflow_management Rational DOORS Next Generation Engineering Workflow Management Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.36%

||

7 Day CHG~0.00%

Published-29 Jul, 2020 | 14:05

Updated-16 Sep, 2024 | 17:08

IBM Planning Analytics Local 2.0.0 through 2.0.9.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 185717.

Vendor-IBM Corporation

Product-planning_analytics_local Planning Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 4.22%

||

7 Day CHG-0.03%

Published-08 Dec, 2025 | 21:58

Updated-11 Dec, 2025 | 00:01

IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site Scripting

IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.

Vendor-IBM Corporation

Product-websphere_application_server WebSphere Application Server Liberty WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.90%

||

7 Day CHG~0.00%

Published-12 Nov, 2021 | 15:20

Updated-17 Sep, 2024 | 01:41

IBM Security SiteProtector System 3.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174052.

Vendor-IBM Corporation

Product-security_siteprotector_system Security SiteProtector System

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.06% / 18.57%

||

7 Day CHG~0.00%

Published-01 Dec, 2023 | 21:03

Updated-02 Aug, 2024 | 20:37

IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 269506.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.90%

||

7 Day CHG~0.00%

Published-28 Jul, 2021 | 12:25

Updated-16 Sep, 2024 | 17:44

IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192957.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager engineering_test_management rational_quality_manager rational_team_concert rational_collaborative_lifecycle_management engineering_workflow_management engineering_lifecycle_optimization_-_engineering_insights engineering_requirements_quality_assistant_on-premises Rational Quality Manager Rational DOORS Next Generation Engineering Workflow Management Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Engineering Test Management Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.36%

||

7 Day CHG~0.00%

Published-07 Jan, 2021 | 17:40

Updated-16 Sep, 2024 | 18:54

IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190979.

Vendor-IBM Corporation

Product-emptoris_contract_management Emptoris Contract Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.17% / 37.78%

||

7 Day CHG~0.00%

Published-12 Oct, 2020 | 13:20

Updated-17 Sep, 2024 | 00:51

IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188197.

Vendor-IBM Corporation

Product-infosphere_information_server InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.33% / 56.04%

||

7 Day CHG~0.00%

Published-08 Sep, 2020 | 14:30

Updated-17 Sep, 2024 | 04:29

IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182371.

Vendor-IBM Corporation

Product-business_automation_workflow business_process_manager Business Process Manager Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.11%

||

7 Day CHG~0.00%

Published-04 Aug, 2020 | 16:00

Updated-17 Sep, 2024 | 03:18

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179359.

Vendor-IBM Corporation

Product-engineering_test_management Rational Rhapsody Design Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.20%

||

7 Day CHG~0.00%

Published-27 Jan, 2021 | 16:15

Updated-17 Sep, 2024 | 01:46

IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190457.

Vendor-IBM Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.90%

||

7 Day CHG~0.00%

Published-08 Nov, 2021 | 16:50

Updated-16 Sep, 2024 | 17:03

IBM QRadar Network Security 5.4.0 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174269.

Vendor-IBM Corporation

Product-qradar_network_security QRadar Network Security

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.36%

||

7 Day CHG~0.00%

Published-16 Nov, 2020 | 16:40

Updated-17 Sep, 2024 | 04:20

IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186285.

Vendor-IBM Corporation

Product-business_automation_workflow Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')