CVE-2025-36138 | ByteOS Network

Vulnerability Details :

CVE-2025-36138

Assigner-ibm

Assigner Org ID-9a959283-ebb5-44b6-b705-dcc2bbced522

Published At-27 Oct, 2025 | 18:47

Updated At-27 Oct, 2025 | 19:27

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:ibm

Assigner Org ID:9a959283-ebb5-44b6-b705-dcc2bbced522

Published At:27 Oct, 2025 | 18:47

Updated At:27 Oct, 2025 | 19:27

▼CVE Numbering Authority (CNA)

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Products

Vendor

IBM Corporation

Product

Default Status

unaffected

Versions

Affected

From 7.5.0 through 7.5.0 Update Pack 13 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	6.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Credits

finder

Fahimhusain Raydurg

References

Hyperlink	Resource
https://www.ibm.com/support/pages/node/7249278	vendor-advisory patch

Hyperlink: https://www.ibm.com/support/pages/node/7249278

Resource:

vendor-advisory

patch

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:psirt@us.ibm.com

Published At:27 Oct, 2025 | 19:16

Updated At:15 Dec, 2025 | 18:28

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CPE Matches

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_1:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_01:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_02:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_2:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_3:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_4:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_5:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_6:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_7:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_8:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_9:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	psirt@us.ibm.com

CWE ID: CWE-79

Type: Secondary

Source: psirt@us.ibm.com

References

Hyperlink	Source	Resource
https://www.ibm.com/support/pages/node/7249278	psirt@us.ibm.com	Vendor Advisory

Hyperlink: https://www.ibm.com/support/pages/node/7249278

Source: psirt@us.ibm.com

Resource:

Vendor Advisory

Similar CVEs

12212Records found

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.31% / 53.62%

||

7 Day CHG~0.00%

Published-17 May, 2018 | 21:00

Updated-16 Sep, 2024 | 20:27

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 140362.

Vendor-IBM Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.38% / 58.96%

||

7 Day CHG~0.00%

Published-23 Sep, 2022 | 17:35

Updated-22 May, 2025 | 15:16

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236586.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows infosphere_information_server linux_kernel aix InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.05% / 16.24%

||

7 Day CHG~0.00%

Published-02 Feb, 2024 | 03:08

Updated-03 Aug, 2024 | 12:28

IBM Aspera Faspex cross-site scripting

IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236441.

Vendor-IBM Corporation

Product-aspera_faspex Aspera Faspex

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 7.38%

||

7 Day CHG~0.00%

Published-03 Feb, 2026 | 22:12

Updated-25 Feb, 2026 | 18:55

IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting

IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-engineering_lifecycle_management Engineering Lifecycle Management - Global Configuration Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 8.80%

||

7 Day CHG~0.00%

Published-20 Jan, 2026 | 15:37

Updated-26 Jan, 2026 | 19:46

Multiple vulnerabilities found in IBM ApplinX.

IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-applinx ApplinX

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 9.86%

||

7 Day CHG~0.00%

Published-20 Jan, 2026 | 15:33

Updated-26 Jan, 2026 | 19:46

Multiple vulnerabilities found in IBM ApplinX.

IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-applinx ApplinX

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.55%

||

7 Day CHG~0.00%

Published-13 Apr, 2025 | 11:56

Updated-01 Sep, 2025 | 10:15

IBM Aspera Faspex 5 cross-site scripting

IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-Linux Kernel Organization, Inc IBM Corporation

Product-aspera_faspex linux_kernel Aspera Faspex

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.02% / 3.58%

||

7 Day CHG-0.03%

Published-29 Sep, 2025 | 14:25

Updated-03 Oct, 2025 | 17:54

IBM License Metric Tool cross-site scripting

IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-license_metric_tool License Metric Tool

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 3.58%

||

7 Day CHG-0.03%

Published-30 Sep, 2025 | 19:41

Updated-03 Oct, 2025 | 17:52

IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-planning_analytics_local Planning Analytics Local

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 8.80%

||

7 Day CHG~0.00%

Published-20 Jan, 2026 | 15:15

Updated-03 Feb, 2026 | 21:57

Multiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.

IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_connect\Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.04% / 10.63%

||

7 Day CHG~0.00%

Published-07 Nov, 2025 | 18:26

Updated-11 Dec, 2025 | 23:44

IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Cross-Site Scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_b2b_integrator sterling_file_gateway Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 4.90%

||

7 Day CHG~0.00%

Published-15 Aug, 2025 | 19:19

Updated-01 Dec, 2025 | 18:06

IBM TS4500 cross-site scripting

IBM TS4500 1.11.0.0-D00, 1.11.0.1-C00, 1.11.0.2-C00, and 1.10.00-F00 web GUI is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-storage_ts4500_library diamondback_tape_library_firmware diamondback_tape_library storage_ts4500_library_firmware Storage TS4500 Library

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.05% / 15.04%

||

7 Day CHG+0.01%

Published-27 Oct, 2025 | 18:46

Updated-15 Dec, 2025 | 18:26

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-qradar_security_information_and_event_manager QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 4.90%

||

7 Day CHG~0.00%

Published-22 Aug, 2025 | 14:55

Updated-15 Sep, 2025 | 19:53

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Dashboard is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-qradar_incident_forensics qradar_security_information_and_event_manager QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.02% / 5.05%

||

7 Day CHG~0.00%

Published-08 Jul, 2025 | 14:51

Updated-24 Aug, 2025 | 11:31

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-aix sterling_b2b_integrator windows sterling_file_gateway linux_kernel Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.06% / 18.31%

||

7 Day CHG~0.00%

Published-02 Nov, 2023 | 23:44

Updated-05 Sep, 2024 | 14:34

IBM CICS TX cross-site scripting

IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 266059.

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc

Product-txseries_for_multiplatforms linux_kernel cics_tx hp-ux windows aix CICS TX Advanced CICS TX Standard TXSeries for Multiplatforms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 4.90%

||

7 Day CHG~0.00%

Published-01 Sep, 2025 | 14:22

Updated-03 Sep, 2025 | 16:05

IBM Concert Software cross-site scripting

IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-concert Concert Software

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 9.90%

||

7 Day CHG~0.00%

Published-22 May, 2025 | 16:37

Updated-26 Aug, 2025 | 15:04

IBM Aspera Faspex HTML injection

IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel aspera_faspex Aspera Faspex

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.02% / 5.33%

||

7 Day CHG~0.00%

Published-01 Aug, 2025 | 17:21

Updated-14 Aug, 2025 | 18:49

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-qradar_security_information_and_event_manager QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.38% / 58.96%

||

7 Day CHG~0.00%

Published-11 Nov, 2022 | 18:52

Updated-01 May, 2025 | 13:26

IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236688.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.58% / 68.58%

||

7 Day CHG~0.00%

Published-11 Nov, 2022 | 18:21

Updated-01 May, 2025 | 13:40

IBM WebSphere Application Server cross-site scripting

IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236588.

Vendor-Linux Kernel Organization, Inc Microsoft Corporation Oracle Corporation HP Inc.IBM Corporation

Product-solaris linux_kernel websphere_application_server i hp-ux windows z\/os aix WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.02% / 5.05%

||

7 Day CHG~0.00%

Published-15 Jul, 2025 | 14:29

Updated-18 Aug, 2025 | 01:34

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 - 7.5.0 UP12 IF02 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel qradar_security_information_and_event_manager QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.12% / 31.75%

||

7 Day CHG~0.00%

Published-10 Dec, 2024 | 13:49

Updated-15 Aug, 2025 | 18:33

IBM Carbon Design System cross-site scripting

IBM Carbon Design System (Carbon Charts 0.4.0 through 1.13.16) is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-carbon_charts Carbon Charts

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 4.90%

||

7 Day CHG~0.00%

Published-19 Aug, 2025 | 19:03

Updated-18 Sep, 2025 | 15:34

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator 6.2.1.0 and IBM Sterling File Gateway 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_b2b_integrator sterling_file_gateway Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 4.90%

||

7 Day CHG~0.00%

Published-01 Sep, 2025 | 14:22

Updated-03 Sep, 2025 | 16:05

IBM Concert Software cross-site scripting

IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-concert Concert Software

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.04% / 13.28%

||

7 Day CHG~0.00%

Published-31 Jan, 2025 | 16:01

Updated-05 Mar, 2025 | 18:17

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.09% / 25.43%

||

7 Day CHG~0.00%

Published-07 Dec, 2024 | 14:49

Updated-09 Dec, 2024 | 15:59

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 6.12%

||

7 Day CHG~0.00%

Published-30 Jun, 2025 | 14:39

Updated-24 Aug, 2025 | 11:36

IBM Cloud Pak System HTML injection

IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Vendor-IBM Corporation

Product-cloud_pak_system Cloud Pak System

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.28% / 51.19%

||

7 Day CHG~0.00%

Published-17 Nov, 2022 | 16:48

Updated-29 Apr, 2025 | 13:46

Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233978.

Vendor-IBM Corporation

Product-business_automation_workflow Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.04% / 10.38%

||

7 Day CHG~0.00%

Published-01 Jun, 2025 | 11:35

Updated-26 Aug, 2025 | 14:55

IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-planning_analytics_local Planning Analytics Local

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.18%

||

7 Day CHG~0.00%

Published-30 Aug, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128171.

Vendor-IBM Corporation

Product-emptoris_spend_analysis Emptoris Spend Analysis

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.38% / 58.96%

||

7 Day CHG~0.00%

Published-11 Nov, 2022 | 18:44

Updated-01 May, 2025 | 13:39

IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233663.

Vendor-Linux Kernel Organization, Inc IBM Corporation

Product-cloud_pak_for_security linux_kernel Cloud Pak for Security

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.11% / 28.83%

||

7 Day CHG~0.00%

Published-05 Feb, 2025 | 11:28

Updated-12 Aug, 2025 | 16:28

IBM Cloud Pak for Business Automation cross-site scripting

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-cloud_pak_for_business_automation Cloud Pak for Business Automation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 9.90%

||

7 Day CHG~0.00%

Published-16 May, 2025 | 00:44

Updated-26 Aug, 2025 | 15:06

IBM Content Navigator HTML injection

IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Vendor-IBM Corporation

Product-content_navigator Content Navigator

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.05% / 14.84%

||

7 Day CHG~0.00%

Published-31 Jan, 2025 | 15:24

Updated-05 Mar, 2025 | 18:17

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.20% / 41.61%

||

7 Day CHG~0.00%

Published-11 Nov, 2024 | 16:01

Updated-18 Nov, 2024 | 16:33

IBM Maximo Asset Management cross-site scripting

IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-maximo_asset_management Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.33% / 55.63%

||

7 Day CHG~0.00%

Published-28 Sep, 2022 | 15:55

Updated-20 May, 2025 | 21:15

IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231381.

Vendor-IBM Corporation

Product-jazz_for_service_management Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.53% / 66.95%

||

7 Day CHG~0.00%

Published-23 Sep, 2022 | 17:35

Updated-22 May, 2025 | 19:15

IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231380.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-windows linux_kernel jazz_for_service_management aix Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.03% / 9.32%

||

7 Day CHG~0.00%

Published-27 May, 2025 | 22:41

Updated-26 Aug, 2025 | 15:03

IBM DS8900F and DS8A00 Hardware Management Console (HMC) cross-site scripting

IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-hardware_management_console_r9.3_firmware hardware_management_console_r9.3 hardware_management_console_r9.4_firmware hardware_management_console_r9.4 hardware_management_console_r10.0_firmware hardware_management_console_r10.0 Hardware Management Console

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.49% / 65.39%

||

7 Day CHG~0.00%

Published-03 Nov, 2022 | 00:00

Updated-02 May, 2025 | 21:15

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592."

Vendor-n/a IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-aix infosphere_information_server windows linux_kernel IBM InfoSphere Information Server

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.12% / 31.00%

||

7 Day CHG~0.00%

Published-02 Mar, 2023 | 20:14

Updated-05 Mar, 2025 | 19:53

IBM Maximo Asset Management cross-site scripting

IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 230958.

Vendor-IBM Corporation

Product-maximo_application_suite maximo_asset_management Maximo Asset Management Maximo Application Suite

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.38% / 58.96%

||

7 Day CHG~0.00%

Published-26 Aug, 2022 | 17:25

Updated-16 Sep, 2024 | 19:50

IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231116.

Vendor-IBM Corporation

Product-maximo_asset_management Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.04% / 13.28%

||

7 Day CHG~0.00%

Published-31 Jan, 2025 | 16:13

Updated-13 Aug, 2025 | 17:40

IBM Financial Transaction Manager cross-site scripting

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-Linux Kernel Organization, Inc IBM Corporation

Product-linux_kernel linux_on_ibm_z aix financial_transaction_manager_for_multiplatform Financial Transaction Manager for SWIFT Services for Multiplatforms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.11% / 28.83%

||

7 Day CHG~0.00%

Published-05 Feb, 2025 | 23:26

Updated-22 Feb, 2025 | 22:03

IBM ApplinX Cross-Site Scripting

IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-applinx ApplinX

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.07% / 20.43%

||

7 Day CHG~0.00%

Published-20 Feb, 2025 | 12:09

Updated-15 Aug, 2025 | 14:43

IBM OpenPages HTML injection

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to HTML injection, caused by improper validation of user-supplied input of text fields used to construct workflow email notifications. A remote authenticated attacker could exploit this vulnerability using HTML tags in a text field of an object to inject malicious script into an email which would be executed in a victim's mail client within the security context of the OpenPages mail message. An attacker could use this for phishing or identity theft attacks.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-openpages_with_watson linux_kernel windows OpenPages with Watson

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 4.90%

||

7 Day CHG~0.00%

Published-28 Aug, 2025 | 14:09

Updated-26 Nov, 2025 | 16:31

IBM Watson Studio on Cloud Pak for Data cross-site scripting

IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-watson_assistant_for_ibm_cloud_pak_for_data Watson Studio on Cloud Pak for Data

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.16%

||

7 Day CHG~0.00%

Published-13 Jul, 2022 | 16:40

Updated-16 Sep, 2024 | 22:20

IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 230516.

Vendor-IBM Corporation

Product-i i

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.43% / 62.18%

||

7 Day CHG~0.00%

Published-08 Jul, 2022 | 17:00

Updated-17 Sep, 2024 | 03:38

IBM CICS TX Standard and Advanced 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229430.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel cics_tx CICS TX Advanced CICS TX Standard

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.65% / 70.49%

||

7 Day CHG~0.00%

Published-14 Nov, 2022 | 19:10

Updated-29 Apr, 2025 | 19:32

IBM CICS TX cross-site scripting

IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229459.

Vendor-IBM Corporation

Product-cics_tx CICS TX

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 8.80%

||

7 Day CHG~0.00%

Published-20 Jan, 2026 | 15:22

Updated-26 Jan, 2026 | 19:46

Security vulnerabilities have been found in IBM Application Gateway

IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-application_gateway Application Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')