CVE-2026-1276 | ByteOS Network

Vulnerability Details :

CVE-2026-1276

Assigner-ibm

Assigner Org ID-9a959283-ebb5-44b6-b705-dcc2bbced522

Published At-19 Mar, 2026 | 01:55

Updated At-19 Mar, 2026 | 17:00

IBM QRadar SIEM Cross-Site Scripting

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:ibm

Assigner Org ID:9a959283-ebb5-44b6-b705-dcc2bbced522

Published At:19 Mar, 2026 | 01:55

Updated At:19 Mar, 2026 | 17:00

▼CVE Numbering Authority (CNA)

IBM QRadar SIEM Cross-Site Scripting

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Products

Vendor

IBM Corporation

Product

CPEs

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14:*:*:*:*:*:*

Default Status

unaffected

Versions

Affected

From 7.5.0 through 7.5.0 Update Pack 14 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Solutions

ProductVersionFixIBM QRadar SIEM 7.5.0 7.5.0 UP15 https://www.ibm.com/support/fixcentral/swg/selectFixes ( Release Notes https://www.ibm.com/support/pages/node/7257011 )

References

Hyperlink	Resource
https://www.ibm.com/support/pages/node/7266709	vendor-advisory patch

Hyperlink: https://www.ibm.com/support/pages/node/7266709

Resource:

vendor-advisory

patch

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:psirt@us.ibm.com

Published At:19 Mar, 2026 | 03:16

Updated At:24 Mar, 2026 | 21:13

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CPE Matches

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_1:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_2:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_3:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_4:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_5:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_6:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_7:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_8:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.5.0

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_9:*:*:*:*:*:*

Linux Kernel Organization, Inc

>>linux_kernel>>-

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	psirt@us.ibm.com

CWE ID: CWE-79

Type: Primary

Source: psirt@us.ibm.com

References

Hyperlink	Source	Resource
https://www.ibm.com/support/pages/node/7266709	psirt@us.ibm.com	Vendor Advisory

Hyperlink: https://www.ibm.com/support/pages/node/7266709

Source: psirt@us.ibm.com

Resource:

Vendor Advisory

Similar CVEs

11438Records found

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.4||MEDIUM

EPSS-0.55% / 68.00%

||

7 Day CHG~0.00%

Published-09 Dec, 2022 | 18:09

Updated-29 Oct, 2025 | 17:44

IBM Cloud Transformation Advisor cross-site scripting

IBM Cloud Transformation Advisor 2.0.1 through 3.3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 237214.

Vendor-IBM Corporation

Product-transformation_advisor Cloud Transformation Advisor

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-6.5||MEDIUM

EPSS-0.27% / 50.42%

||

7 Day CHG~0.00%

Published-22 Nov, 2019 | 11:51

Updated-05 Aug, 2024 | 07:46

cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.

Vendor-Linux Kernel Organization, Inc Red Hat, Inc.

Product-cloudforms_management_engine linux_kernel cloudforms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.05% / 16.34%

||

7 Day CHG~0.00%

Published-02 Feb, 2024 | 03:08

Updated-03 Aug, 2024 | 12:28

IBM Aspera Faspex cross-site scripting

IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236441.

Vendor-IBM Corporation

Product-aspera_faspex Aspera Faspex

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.38% / 59.31%

||

7 Day CHG~0.00%

Published-11 Nov, 2022 | 18:52

Updated-01 May, 2025 | 13:26

IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236688.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.65% / 70.86%

||

7 Day CHG~0.00%

Published-02 Mar, 2023 | 20:14

Updated-05 Mar, 2025 | 19:53

IBM Maximo Asset Management cross-site scripting

IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 230958.

Vendor-IBM Corporation

Product-maximo_application_suite maximo_asset_management Maximo Asset Management Maximo Application Suite

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.66% / 71.05%

||

7 Day CHG~0.00%

Published-11 Nov, 2022 | 18:21

Updated-01 May, 2025 | 13:40

IBM WebSphere Application Server cross-site scripting

IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236588.

Vendor-Linux Kernel Organization, Inc Microsoft Corporation Oracle Corporation HP Inc.IBM Corporation

Product-solaris linux_kernel websphere_application_server i hp-ux windows z\/os aix WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.38% / 59.31%

||

7 Day CHG~0.00%

Published-23 Sep, 2022 | 17:35

Updated-22 May, 2025 | 15:16

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236586.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows infosphere_information_server linux_kernel aix InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.28% / 51.41%

||

7 Day CHG~0.00%

Published-17 Nov, 2022 | 16:48

Updated-29 Apr, 2025 | 13:46

Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233978.

Vendor-IBM Corporation

Product-business_automation_workflow Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.29%

||

7 Day CHG~0.00%

Published-30 Aug, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128171.

Vendor-IBM Corporation

Product-emptoris_spend_analysis Emptoris Spend Analysis

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 9.15%

||

7 Day CHG~0.00%

Published-25 Mar, 2026 | 20:39

Updated-26 Mar, 2026 | 18:14

IBM InfoSphere Information Server Cross-Site Scripting

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session

Vendor-Linux Kernel Organization, Inc Microsoft Corporation IBM Corporation

Product-linux_kernel aix windows infosphere_information_server InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.39% / 59.88%

||

7 Day CHG~0.00%

Published-16 Sep, 2022 | 02:33

Updated-03 Aug, 2024 | 10:07

Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting (XSS) vulnerability.

Vendor-syncovery n/a Linux Kernel Organization, Inc

Product-syncovery linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.33% / 55.93%

||

7 Day CHG~0.00%

Published-28 Sep, 2022 | 15:55

Updated-20 May, 2025 | 21:15

IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231381.

Vendor-IBM Corporation

Product-jazz_for_service_management Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Dutch Institute for Vulnerability Disclosure (DIVD)

Matching Score-10

Assigner-Dutch Institute for Vulnerability Disclosure (DIVD)

CVSS Score-8.7||HIGH

EPSS-0.15% / 34.76%

||

7 Day CHG~0.00%

Published-10 Jul, 2023 | 06:29

Updated-22 Sep, 2025 | 06:40

Authenticated Stored XSS in OSNEXUS QuantaStor 6.0.0.335

An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters) * click add * click apply * create a test alert * The test alert will run the command “id | tee /tmp/ttttttddddssss” as root. * after the test alert inspect /tmp/ttttttddddssss it'll contain the ids of the root user.

Vendor-osnexus OSNEXUS Linux Kernel Organization, Inc Microsoft Corporation

Product-windows quantastor linux_kernel QuantaStor

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.53% / 67.30%

||

7 Day CHG~0.00%

Published-11 Nov, 2022 | 18:44

Updated-01 May, 2025 | 13:39

IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233663.

Vendor-Linux Kernel Organization, Inc IBM Corporation

Product-cloud_pak_for_security linux_kernel Cloud Pak for Security

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.49% / 65.77%

||

7 Day CHG~0.00%

Published-03 Nov, 2022 | 00:00

Updated-02 May, 2025 | 21:15

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 227592."

Vendor-n/a IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-aix infosphere_information_server windows linux_kernel IBM InfoSphere Information Server

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.53% / 67.30%

||

7 Day CHG~0.00%

Published-23 Sep, 2022 | 17:35

Updated-22 May, 2025 | 19:15

IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231380.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-windows linux_kernel jazz_for_service_management aix Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.38% / 59.31%

||

7 Day CHG~0.00%

Published-26 Aug, 2022 | 17:25

Updated-16 Sep, 2024 | 19:50

IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231116.

Vendor-IBM Corporation

Product-maximo_asset_management Maximo Asset Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.24%

||

7 Day CHG~0.00%

Published-13 Jul, 2022 | 16:40

Updated-16 Sep, 2024 | 22:20

IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 230516.

Vendor-IBM Corporation

Product-i i

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.53% / 67.30%

||

7 Day CHG~0.00%

Published-13 Sep, 2022 | 20:45

Updated-17 Sep, 2024 | 02:52

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229714.

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Product-solaris linux_kernel websphere_application_server i hp-ux windows z\/os aix WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.28% / 51.07%

||

7 Day CHG~0.00%

Published-08 Jul, 2022 | 17:00

Updated-17 Sep, 2024 | 01:01

IBM CICS TX Standard and Advanced 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229432.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel cics_tx CICS TX Advanced CICS TX Standard

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.79% / 73.94%

||

7 Day CHG~0.00%

Published-14 Nov, 2022 | 18:18

Updated-30 Apr, 2025 | 15:42

IBM CICS TX cross-site scripting

IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229451.

Vendor-IBM Corporation

Product-cics_tx CICS TX

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.65% / 70.86%

||

7 Day CHG~0.00%

Published-14 Nov, 2022 | 19:10

Updated-29 Apr, 2025 | 19:32

IBM CICS TX cross-site scripting

IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229459.

Vendor-IBM Corporation

Product-cics_tx CICS TX

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.43% / 62.52%

||

7 Day CHG~0.00%

Published-08 Jul, 2022 | 17:00

Updated-17 Sep, 2024 | 03:38

IBM CICS TX Standard and Advanced 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229430.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel cics_tx CICS TX Advanced CICS TX Standard

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.33% / 55.93%

||

7 Day CHG~0.00%

Published-31 Jul, 2022 | 16:07

Updated-16 Sep, 2024 | 16:23

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228435.

Vendor-IBM Corporation

Product-datapower_gateway DataPower Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.91%

||

7 Day CHG~0.00%

Published-29 Jun, 2021 | 15:50

Updated-17 Sep, 2024 | 01:47

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196949.

Vendor-IBM Corporation

Product-planning_analytics Planning Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-3||LOW

EPSS-0.21% / 42.91%

||

7 Day CHG~0.00%

Published-07 Jan, 2022 | 17:55

Updated-16 Sep, 2024 | 23:55

IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209563.

Vendor-IBM Corporation

Product-security_verify_access Security Verify Access

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.15% / 35.05%

||

7 Day CHG~0.00%

Published-23 Sep, 2021 | 17:40

Updated-17 Sep, 2024 | 00:11

IBM Aspera Cloud is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208343.

Vendor-IBM Corporation

Product-aspera_on_cloud Aspera

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.21%

||

7 Day CHG~0.00%

Published-11 Apr, 2022 | 18:17

Updated-17 Sep, 2024 | 01:26

IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215306.

Vendor-IBM Corporation

Product-curam_social_program_management Curam Social Program Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.12% / 30.65%

||

7 Day CHG~0.00%

Published-16 Aug, 2022 | 18:45

Updated-16 Sep, 2024 | 18:38

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213965.

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Product-sterling_b2b_integrator solaris linux_kernel hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.20% / 41.25%

||

7 Day CHG~0.00%

Published-23 Sep, 2021 | 18:05

Updated-16 Sep, 2024 | 23:21

IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208405.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix jazz_for_service_management windows linux_kernel Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.21%

||

7 Day CHG~0.00%

Published-14 Mar, 2022 | 16:45

Updated-16 Sep, 2024 | 18:29

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214534.

Vendor-IBM Corporation

Product-spectrum_copy_data_management Spectrum Copy Data Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.22% / 43.94%

||

7 Day CHG~0.00%

Published-21 Dec, 2021 | 19:10

Updated-17 Sep, 2024 | 00:26

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209512.

Vendor-IBM Corporation

Product-workflow_process_service business_automation_workflow business_process_manager Cloud Pak for Automation Business Process Manager Standard

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.27% / 50.36%

||

7 Day CHG~0.00%

Published-20 May, 2022 | 16:20

Updated-16 Sep, 2024 | 22:03

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214032.

Vendor-IBM Corporation

Product-jazz_team_server Jazz Team Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.05%

||

7 Day CHG~0.00%

Published-14 Feb, 2022 | 17:30

Updated-16 Sep, 2024 | 18:49

IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215592.

Vendor-IBM Corporation

Product-cognos_analytics_mobile Cognos Analytics Mobile

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.12% / 30.65%

||

7 Day CHG~0.00%

Published-14 Jul, 2022 | 16:15

Updated-25 Mar, 2025 | 14:21

IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213655.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-engineering_lifecycle_optimization_-_publishing engineering_lifecycle_optimization_publishing windows linux_kernel Engineering Lifecycle Optimization Publishing

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.21%

||

7 Day CHG~0.00%

Published-15 Nov, 2021 | 15:35

Updated-16 Sep, 2024 | 20:52

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212791.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel security_guardium_key_lifecycle_manager windows security_key_lifecycle_manager aix Security Key Lifecycle Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.30% / 53.31%

||

7 Day CHG~0.00%

Published-22 Apr, 2022 | 16:30

Updated-16 Sep, 2024 | 20:42

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240.

Vendor-IBM Corporation NetApp, Inc.

Product-cognos_analytics oncommand_insight Cognos Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.38% / 59.31%

||

7 Day CHG~0.00%

Published-29 Aug, 2022 | 21:10

Updated-16 Sep, 2024 | 23:51

IBM Engineering Test Management 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 210671.

Vendor-IBM Corporation

Product-engineering_test_management rational_quality_manager Engineering Test Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.21%

||

7 Day CHG~0.00%

Published-17 Dec, 2021 | 17:05

Updated-16 Sep, 2024 | 19:25

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209165.

Vendor-IBM Corporation

Product-business_automation_workflow business_process_manager Business Process Manager Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.79%

||

7 Day CHG~0.00%

Published-11 May, 2022 | 16:10

Updated-16 Sep, 2024 | 23:46

IBM Jazz Foundation (IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214619.

Vendor-IBM Corporation

Product-jazz_foundation Jazz Team Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.21%

||

7 Day CHG~0.00%

Published-21 Dec, 2021 | 19:10

Updated-17 Sep, 2024 | 01:12

IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212357.

Vendor-IBM Corporation

Product-cloud_pak_for_automation workflow_process_service Cloud Pak for Automation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.31% / 54.14%

||

7 Day CHG~0.00%

Published-12 Jul, 2024 | 17:47

Updated-10 Sep, 2024 | 16:16

IBM InfoSphere Server cross-site scripting

IBM InfoSphere Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 297720.

Vendor-IBM Corporation

Product-infosphere_information_server InfoSphere Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.13% / 31.77%

||

7 Day CHG~0.00%

Published-23 Jan, 2025 | 02:38

Updated-04 Mar, 2025 | 21:36

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator Standard Edition

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.24%

||

7 Day CHG~0.00%

Published-31 Jul, 2022 | 16:05

Updated-16 Sep, 2024 | 20:16

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228358.

Vendor-IBM Corporation

Product-datapower_gateway DataPower Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.14% / 33.02%

||

7 Day CHG~0.00%

Published-31 Jan, 2025 | 15:24

Updated-05 Mar, 2025 | 18:17

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_b2b_integrator Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 9.48%

||

7 Day CHG+0.01%

Published-22 Aug, 2025 | 14:55

Updated-15 Sep, 2025 | 19:53

IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 through 7.5.0 Dashboard is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-qradar_incident_forensics qradar_security_information_and_event_manager QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 5.41%

||

7 Day CHG~0.00%

Published-07 Nov, 2025 | 18:26

Updated-11 Dec, 2025 | 23:44

IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Cross-Site Scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-sterling_b2b_integrator sterling_file_gateway Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.33% / 56.09%

||

7 Day CHG~0.00%

Published-08 Sep, 2020 | 14:30

Updated-17 Sep, 2024 | 04:29

IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182371.

Vendor-IBM Corporation

Product-business_automation_workflow business_process_manager Business Process Manager Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.02% / 5.62%

||

7 Day CHG~0.00%

Published-09 Sep, 2025 | 19:27

Updated-19 Dec, 2025 | 14:38

IBM Hardware Management Console - Power Systems cross-site scripting

IBM Hardware Management Console - Power 10.3.1050.0 and 11.1.1110.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation

Product-hardware_management_console Hardware Management Console

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.22% / 44.73%

||

7 Day CHG~0.00%

Published-04 Sep, 2020 | 13:35

Updated-16 Sep, 2024 | 20:42

IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187187.

Vendor-IBM Corporation

Product-infosphere_information_server InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')