1. Home
  2. Common Vulnerabilities and Exposures
  3. Multiple security vulnerabilities have been found in IBM products

Multiple security vulnerabilities have been found in IBM products

Overview :
Multiple security vulnerabilities have been fixed and delivered in IBM products.
Affected Product(s) :
  • IBM Financial Transaction Manager 3.0
  • IBM Cognos Business Intelligence 10.2.2
  • IBM Cognos Analytics 11.1
  • IBM Cognos Analytics 11.0
Vulnerability Details :
CVE ID : CVE-2019-4736
IBM Financial Transaction Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/172706 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
CVE ID : CVE-2019-4742
IBM Financial Transaction Manager could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/172877 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVE ID : CVE-2019-4743
IBM Financial Transaction Manager does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/172880 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
CVE ID : CVE-2019-4544
IBM Financial Transaction Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 6.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/172882 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVE ID : CVE-2018-1934
IBM Cognos Business Intelligence is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/153179 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
CVE ID : CVE-2019-4231
IBM Cognos Analytics is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159356 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
CVE ID : CVE-2019-4555
IBM Cognos Analytics is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/166204 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Solution :

Affected Product / Version Fix availability
IBM Financial Transaction Manager 3.0 IBM Cognos Business Intelligence 10.2.2 IF22
IBM Cognos Business Intelligence 10.2.2 Fix Pack 13 of IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.0.
IBM Cognos Analytics 11.1 IBM Cognos Analyticxs 11.1.4.0
IBM Cognos Analytics 11.0 IBM Cognos Analytics 11.0.13 Fix Pack 3

Common Vulnerabilityies and Exposures

HejHome GKW-IC052 hard-coded credentials [CVE-2021-26611]

A vulnerability, which was classified as critical, has been found in HejHome GKW-IC052 (affected version not known). Affected by this issue is an unknown part. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Learn more

BaserCMS ZIP File path traversal [CVE-2021-41279]

A vulnerability, which was classified as critical, was found in BaserCMS (Content Management System) (the affected version unknown). This affects an unknown code of the component ZIP File Handler. Upgrading eliminates this vulnerability. Applying the patch d8ab0a81a7bce35cc95ff7dff851a7e87a084336 is able to eliminate this problem. The bugfix is ready for download at […]

Learn more

Bandisoft ARK Library Ark_NormalizeAndDupPAthNameW path value integer overflow

A vulnerability has been found in Bandisoft ARK Library (Software Library) (the affected version is unknown) and classified as critical. This vulnerability affects the function Ark_NormalizeAndDupPAthNameW. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Learn more