Vulnerabilities > IBM > Medium

DATE CVE VULNERABILITY TITLE RISK
2023-10-23 CVE-2023-38722 Cross-site Scripting vulnerability in IBM Sterling Partner Engagement Manager 6.1.2/6.2.0/6.2.2
IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to stored cross-site scripting.
network
low complexity
ibm CWE-79
5.4
2023-10-22 CVE-2023-38735 Improper Authentication vulnerability in IBM Cognos Dashboards on Cloud PAK for Data 4.7.0
IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw.
network
low complexity
ibm CWE-287
6.5
2023-10-17 CVE-2022-43891 Information Exposure Through an Error Message vulnerability in IBM Security Verify Privilege On-Premises
IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.
network
low complexity
ibm CWE-209
5.3
2023-10-17 CVE-2022-43892 Improper Certificate Validation vulnerability in IBM Security Verify Privilege On-Premises
IBM Security Verify Privilege On-Premises 11.5 does not validate, or incorrectly validates, a certificate which could disclose sensitive information which could aid further attacks against the system.
network
low complexity
ibm CWE-295
5.3
2023-10-17 CVE-2021-20581 Insufficient Session Expiration vulnerability in IBM Security Verify Privilege On-Premises
IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain sensitive information due to insufficient session expiration.
network
low complexity
ibm CWE-613
4.3
2023-10-17 CVE-2021-38859 Unspecified vulnerability in IBM Security Verify Privilege On-Premises
IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain version number information using a specially crafted HTTP request that could be used in further attacks against the system.
network
low complexity
ibm
5.3
2023-10-17 CVE-2022-22380 Improper Certificate Validation vulnerability in IBM Security Verify Privilege On-Premises
IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates.
network
low complexity
ibm CWE-295
4.3
2023-10-17 CVE-2022-22386 Missing Encryption of Sensitive Data vulnerability in IBM Security Verify Privilege On-Premises
IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security.
network
high complexity
ibm CWE-311
5.9
2023-10-17 CVE-2022-43889 Unspecified vulnerability in IBM Security Verify Privilege On-Premises
IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks against the system.
network
low complexity
ibm
5.3
2023-10-17 CVE-2022-43893 Resource Exhaustion vulnerability in IBM Security Verify Privilege On-Premises
IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload.
local
low complexity
ibm CWE-400
4.4