CVE-2025-36138 | ByteOS Network

Vulnerability Details :

CVE-2025-36138

Assigner-ibm

Assigner Org ID-9a959283-ebb5-44b6-b705-dcc2bbced522

Published At-27 Oct, 2025 | 18:47

Updated At-27 Oct, 2025 | 19:27

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:ibm

Assigner Org ID:9a959283-ebb5-44b6-b705-dcc2bbced522

Published At:27 Oct, 2025 | 18:47

Updated At:27 Oct, 2025 | 19:27

▼CVE Numbering Authority (CNA)

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Products

Vendor

IBM Corporation

Product

Default Status

unaffected

Versions

Affected

From 7.5.0 through 7.5.0 Update Pack 13 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	6.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Credits

finder

Fahimhusain Raydurg

References

Hyperlink	Resource
https://www.ibm.com/support/pages/node/7249278	vendor-advisory patch

Hyperlink: https://www.ibm.com/support/pages/node/7249278

Resource:

vendor-advisory

patch

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:psirt@us.ibm.com

Published At:27 Oct, 2025 | 19:16

Updated At:15 Dec, 2025 | 18:28

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CPE Matches

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_1:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_01:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_02:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_2:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_3:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_4:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_5:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_6:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_7:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_8:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_9:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	psirt@us.ibm.com

CWE ID: CWE-79

Type: Secondary

Source: psirt@us.ibm.com

References

Hyperlink	Source	Resource
https://www.ibm.com/support/pages/node/7249278	psirt@us.ibm.com	Vendor Advisory

Hyperlink: https://www.ibm.com/support/pages/node/7249278

Source: psirt@us.ibm.com

Resource:

Vendor Advisory

Similar CVEs

12212Records found

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.17% / 38.82%

||

7 Day CHG~0.00%

Published-01 Oct, 2019 | 14:30

Updated-16 Sep, 2024 | 19:56

IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164116.

Vendor-IBM Corporation

Product-jazz_reporting_service Jazz Reporting Service

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.23% / 45.90%

||

7 Day CHG~0.00%

Published-05 Sep, 2019 | 14:50

Updated-16 Sep, 2024 | 22:25

IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018.03, V8.5.7.0 through V8.5.7.0 Cumulative Fix 2017.06, and V8.5.6.0 through V8.5.6.0 CF2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158415.

Vendor-IBM Corporation

Product-business_automation_workflow business_process_manager Business Process Manager Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.17% / 38.39%

||

7 Day CHG~0.00%

Published-24 Feb, 2024 | 15:40

Updated-13 Feb, 2025 | 17:13

IBM Cognos Analytics cross-site scripting

IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 267451.

Vendor-NetApp, Inc.IBM Corporation

Product-cognos_analytics oncommand_insight Cognos Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.19% / 40.35%

||

7 Day CHG~0.00%

Published-09 Dec, 2019 | 22:30

Updated-17 Sep, 2024 | 01:30

IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162807.

Vendor-IBM Corporation

Product-watson_assistant_for_ibm_cloud_pak_for_data Watson Assistant for IBM Cloud Pak for Data

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.51%

||

7 Day CHG~0.00%

Published-16 Jul, 2020 | 15:05

Updated-17 Sep, 2024 | 00:40

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173174.

Vendor-IBM Corporation

Product-rational_doors_next_generation engineering_test_management rational_quality_manager rational_team_concert engineering_lifecycle_manager engineering_workflow_management reference_data_management doors_next collaborative_lifecycle_management rhapsody_design_manager Rational Quality Manager Rational DOORS Next Generation Engineering Workflow Management Rational Rhapsody Design Manager Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.17% / 38.82%

||

7 Day CHG~0.00%

Published-17 Sep, 2019 | 19:05

Updated-17 Sep, 2024 | 00:51

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 160203.

Vendor-IBM Corporation

Product-websphere_application_server WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.17% / 38.82%

||

7 Day CHG~0.00%

Published-25 Apr, 2019 | 14:36

Updated-17 Sep, 2024 | 01:36

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159464.

Vendor-IBM Corporation

Product-infosphere_information_server_on_cloud infosphere_information_server InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.85%

||

7 Day CHG~0.00%

Published-09 Nov, 2019 | 01:41

Updated-17 Sep, 2024 | 01:15

IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163779.

Vendor-IBM Corporation

Product-qradar_security_information_and_event_manager QRadar

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.17% / 38.82%

||

7 Day CHG~0.00%

Published-25 Apr, 2019 | 14:36

Updated-16 Sep, 2024 | 20:21

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 157107.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 47.15%

||

7 Day CHG~0.00%

Published-06 Mar, 2019 | 20:00

Updated-16 Sep, 2024 | 22:30

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155946.

Vendor-IBM Corporation

Product-websphere_application_server websphere_virtual_enterprise WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.06% / 18.79%

||

7 Day CHG~0.00%

Published-01 Dec, 2023 | 20:57

Updated-02 Aug, 2024 | 19:16

IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265938.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.51%

||

7 Day CHG~0.00%

Published-10 Apr, 2025 | 13:24

Updated-17 Aug, 2025 | 00:09

IBM Sterling Control Center cross-site scripting

IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel windows sterling_control_center aix linux_on_ibm_z Sterling Control Center

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.07% / 22.25%

||

7 Day CHG~0.00%

Published-01 Dec, 2023 | 20:52

Updated-02 Aug, 2024 | 19:16

IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265504.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.10% / 28.02%

||

7 Day CHG~0.00%

Published-27 Jun, 2024 | 18:00

Updated-02 Aug, 2024 | 19:16

IBM Sterling B2B Integrator Standard Edition cross-site scripting

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.2.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265511.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator Standard Edition

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.55%

||

7 Day CHG~0.00%

Published-02 Apr, 2025 | 15:08

Updated-15 Aug, 2025 | 14:41

IBM Content Navigator cross-site scripting

IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-content_navigator windows linux_kernel aix Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.07% / 22.25%

||

7 Day CHG~0.00%

Published-04 Oct, 2023 | 13:38

Updated-19 Sep, 2024 | 14:45

IBM Content Navigator cross-site scripting

IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 264019.

Vendor-IBM Corporation

Product-content_navigator Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.06% / 18.52%

||

7 Day CHG~0.00%

Published-14 Oct, 2023 | 16:46

Updated-16 Sep, 2024 | 19:20

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 263376.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-qradar_security_information_and_event_manager linux_kernel QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.06% / 17.82%

||

7 Day CHG~0.00%

Published-23 Oct, 2023 | 17:40

Updated-11 Sep, 2024 | 14:17

IBM Sterling Partner Engagement Manager cross-site scripting

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 262174.

Vendor-IBM Corporation

Product-sterling_partner_engagement_manager Sterling Partner Engagement Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 6.80%

||

7 Day CHG~0.00%

Published-27 Jun, 2025 | 14:48

Updated-17 Aug, 2025 | 00:24

IBM Cloud Pak System HTML injection

IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Vendor-IBM Corporation

Product-cloud_pak_system Cloud Pak System

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.07% / 20.80%

||

7 Day CHG~0.00%

Published-13 Mar, 2024 | 09:16

Updated-14 Jan, 2025 | 20:00

Maximo Asset Management cross-site scripting

IBM Maximo Application Suite 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 262192.

Vendor-IBM Corporation

Product-maximo_application_suite Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.55%

||

7 Day CHG~0.00%

Published-02 Apr, 2025 | 15:32

Updated-01 Sep, 2025 | 00:56

IBM TXSeries for Multiplatforms cross-site scripting

IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-txseries_for_multiplatforms linux_kernel aix TXSeries for Multiplatforms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.09% / 26.01%

||

7 Day CHG~0.00%

Published-28 May, 2024 | 12:06

Updated-14 Jan, 2025 | 20:22

IBM Aspera Faspex cross-site scripting

IBM Aspera Faspex 5.0.0 through 5.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260139.

Vendor-IBM Corporation

Product-aspera_faspex Aspera Faspex

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.14% / 33.33%

||

7 Day CHG~0.00%

Published-04 Oct, 2023 | 00:38

Updated-19 Sep, 2024 | 19:27

IBM FileNet Content Manager cross-site scripting

IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 259384.

Vendor-IBM Corporation

Product-filenet_content_manager FileNet Content Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.10% / 26.96%

||

7 Day CHG~0.00%

Published-10 Jul, 2024 | 15:23

Updated-15 Sep, 2025 | 20:15

IBM Security ReaQta HTML injection

IBM Security QRadar EDR 3.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Vendor-IBM Corporation

Product-security_qradar_edr Security QRadar EDR

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.22%

||

7 Day CHG~0.00%

Published-21 Feb, 2024 | 14:29

Updated-10 Dec, 2024 | 17:46

IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 256544.

Vendor-IBM Corporation

Product-infosphere_information_server InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.08% / 22.68%

||

7 Day CHG~0.00%

Published-08 Jun, 2023 | 00:39

Updated-06 Jan, 2025 | 20:02

IBM CICS TX cross-site scripting

IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 257100.

Vendor-HP Inc.IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel txseries_for_multiplatform cics_tx hp-ux aix CICS TX Advanced CICS TX Standard TXSeries for Multiplatforms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.51%

||

7 Day CHG~0.00%

Published-09 Apr, 2025 | 14:03

Updated-16 Aug, 2025 | 23:42

IBM Security Verify Governance cross-site scripting

IBM Security Verify Governance 10.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-security_verify_governance Security Verify Governance

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.10% / 27.99%

||

7 Day CHG~0.00%

Published-23 Jan, 2025 | 02:37

Updated-04 Mar, 2025 | 21:36

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator Standard Edition

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.10% / 26.66%

||

7 Day CHG~0.00%

Published-27 Aug, 2023 | 22:21

Updated-30 Sep, 2024 | 17:51

IBM Security Guardium cross-site scripting

IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 252292.

Vendor-IBM Corporation

Product-security_guardium Security Guardium

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-8.9||HIGH

EPSS-0.10% / 27.87%

||

7 Day CHG~0.00%

Published-27 Aug, 2023 | 22:18

Updated-01 Oct, 2024 | 20:05

IBM Security Guardium cross-site scripting

IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 252291.

Vendor-IBM Corporation

Product-security_guardium Security Guardium security_guardium

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.11% / 28.83%

||

7 Day CHG~0.00%

Published-05 Feb, 2025 | 22:58

Updated-07 Mar, 2025 | 19:37

IBM Aspera Shares Cross-Site Scripting

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-aspera_shares Aspera Shares

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.74%

||

7 Day CHG~0.00%

Published-27 Apr, 2021 | 16:32

Updated-16 Sep, 2024 | 22:55

IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199400.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-spectrum_scale linux_kernel Spectrum Scale

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.10% / 28.73%

||

7 Day CHG~0.00%

Published-29 Sep, 2021 | 15:55

Updated-17 Sep, 2024 | 01:56

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204832.

Vendor-IBM Corporation

Product-business_automation_workflow business_process_manager Business Process Manager Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.16% / 37.03%

||

7 Day CHG~0.00%

Published-28 Jun, 2021 | 15:55

Updated-16 Sep, 2024 | 16:52

IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203029.

Vendor-IBM Corporation

Product-cloud_pak_for_automation business_automation_workflow Cloud Pak for Automation Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.09%

||

7 Day CHG~0.00%

Published-02 Jun, 2021 | 20:40

Updated-17 Sep, 2024 | 02:42

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199406.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager engineering_test_management rational_quality_manager engineering_lifecycle_optimization_-_publishing removable_media_manager engineering_lifecycle_optimization_-_engineering_insights collaborative_lifecycle_management engineering_lifecycle_management Rational Quality Manager Rational DOORS Next Generation Rational Rhapsody Model Manager Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Engineering Test Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.69%

||

7 Day CHG~0.00%

Published-27 Oct, 2021 | 16:00

Updated-16 Sep, 2024 | 16:32

IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager rational_team_concert engineering_lifecycle_optimization rational_collaborative_lifecycle_management Rational DOORS Next Generation Engineering Workflow Management Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.06% / 17.04%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:56

Updated-01 Sep, 2025 | 01:10

IBM Business Automation Workflow cross-site scripting

IBM Business Automation Workflow and IBM Business Automation Workflow Enterprise Service Bus 24.0.0, 24.0.1 and earlier unsupported versions are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-business_automation_workflow Business Automation Workflow Enterprise Service Bus Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 5.53%

||

7 Day CHG~0.00%

Published-18 Jun, 2025 | 15:08

Updated-24 Aug, 2025 | 11:47

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.88%

||

7 Day CHG~0.00%

Published-19 Jul, 2021 | 16:00

Updated-17 Sep, 2024 | 03:12

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198235.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager rational_team_concert engineering_lifecycle_optimization rational_collaborative_lifecycle_management engineering_workflow_management engineering_requirements_quality_assistant_on-premises Rational DOORS Next Generation Engineering Workflow Management Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.13% / 32.66%

||

7 Day CHG~0.00%

Published-19 May, 2023 | 15:44

Updated-21 Jan, 2025 | 19:33

IBM InfoSphere Information Server 11.7

IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 251213.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.74%

||

7 Day CHG~0.00%

Published-27 Apr, 2021 | 16:32

Updated-17 Sep, 2024 | 04:04

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199167.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-content_navigator windows aix linux_kernel Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.09% / 25.40%

||

7 Day CHG~0.00%

Published-18 Dec, 2024 | 23:39

Updated-19 Dec, 2024 | 16:39

IBM Sterling B2B Integrator Standard Edition cross-site scripting

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.09% / 24.99%

||

7 Day CHG~0.00%

Published-24 Jun, 2022 | 16:15

Updated-17 Sep, 2024 | 00:10

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 198929.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-jazz_team_server windows linux_kernel Jazz Team Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.74%

||

7 Day CHG~0.00%

Published-27 Apr, 2021 | 16:32

Updated-16 Sep, 2024 | 16:53

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199168.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-content_navigator windows aix linux_kernel Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 34.44%

||

7 Day CHG~0.00%

Published-30 Mar, 2021 | 16:45

Updated-17 Sep, 2024 | 00:06

IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198437.

Vendor-IBM Corporation

Product-rational_engineering_lifecycle_manager engineering_insights rational_team_concert engineering_workflow_management engineering_lifecycle_management engineering_requirements_quality_assistant_on-premises Engineering Workflow Management Rational Engineering Lifecycle Manager Engineering Lifecycle Optimization Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.9||MEDIUM

EPSS-0.15% / 35.53%

||

7 Day CHG~0.00%

Published-07 Oct, 2021 | 18:05

Updated-16 Sep, 2024 | 22:24

IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199246.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 34.44%

||

7 Day CHG~0.00%

Published-19 May, 2021 | 19:40

Updated-17 Sep, 2024 | 02:32

IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198761.

Vendor-IBM Corporation

Product-control_center Control Center

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 34.44%

||

7 Day CHG~0.00%

Published-27 Apr, 2021 | 16:32

Updated-16 Sep, 2024 | 23:31

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196624.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-content_navigator windows aix linux_kernel Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.09%

||

7 Day CHG~0.00%

Published-29 Jun, 2021 | 15:50

Updated-17 Sep, 2024 | 01:47

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196949.

Vendor-IBM Corporation

Product-planning_analytics Planning Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 34.44%

||

7 Day CHG~0.00%

Published-18 Feb, 2021 | 15:10

Updated-16 Sep, 2024 | 19:05

IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196622.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows maximo_for_civil_infrastructure linux_kernel Maximo for Civil Infrastructure

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')