IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive information through user enumeration. IBM X-Force ID: 175422.

CVE-2020-4248LOWCVSS 2.7EG 2.7

2020-05-28

IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks aga…

CVE-2020-4249MEDIUMCVSS 6.5EG 6.5

2020-05-28

IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authenticated users on the sytem due to incorrect authorization. IBM X-Force ID: 175485.

CVE-2020-4260MEDIUMCVSS 4.3EG 4.3

2020-04-16

IBM UrbanCode Deploy (UCD) 7.0.5 could allow a user with special permissions to obtain sensitive information via generic processes. IBM X-Force ID: 175639.

CVE-2020-4277HIGHCVSS 7.5EG 7.5

2020-04-17

IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-Force ID: 175993.

CVE-2020-4284MEDIUMCVSS 5.3EG 5.3

2020-04-08

IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could disclose sensitive information to an unauthorized user due to insufficient timeout functionality in the Web UI. IBM X-Force ID: 176207.

CVE-2020-4289MEDIUMCVSS 5.3EG 5.3

2020-04-08

IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerab…

CVE-2020-4292MEDIUMCVSS 5.3EG 5.3

2020-03-02

IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that should not be trusted which could disclose sensitive information. IBM X-Force ID: 176335.

CVE-2020-4299MEDIUMCVSS 4.3EG 4.3

2020-05-14

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 could expose sensitive information to a user through a specially crafted HTTP request. IBM X-Force ID: 176606.

CVE-2020-4309MEDIUMCVSS 5.3EG 5.3

2020-03-24

IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user which could be used to aid in further attacks against the system. IBM X-Force ID: 177080.

CVE-2020-4312MEDIUMCVSS 4.3EG 4.3

2020-05-13

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensitive information from a cached web page. IBM X-Force ID: 177089.

CVE-2020-4319MEDIUMCVSS 4.3EG 4.3

2020-07-28

IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub …

CVE-2020-4329MEDIUMCVSS 4.3EG 4.3

2020-04-28

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obtain sensitive information, caused by improper parameter checking. This could be exploited to condu…

CVE-2020-4336MEDIUMCVSS 5.3EG 5.3

2021-01-06

IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: …

CVE-2020-4338MEDIUMCVSS 5.5EG 5.5

2020-04-16

IBM MQ 9.1.4 could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data. IBM X-Force ID: 177937.

CVE-2020-4342MEDIUMCVSS 5.3EG 5.3

2020-06-24

IBM Security Secret Server 10.7 could disclose sensitive information included in installation files to an unauthorized user. IBM X-Force ID: 178182.

CVE-2020-4346MEDIUMCVSS 5.3EG 5.3

2020-05-12

IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information. IBM X-Force ID: 178322.

CVE-2020-4357MEDIUMCVSS 4.3EG 4.3

2020-05-27

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the syst…

CVE-2020-4361MEDIUMCVSS 4.3EG 4.3

2020-07-20

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. IBM X-Force ID: 178766.

CVE-2020-4410MEDIUMCVSS 4.3EG 4.3

2020-08-04

IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to send a specially crafted HTTP GET request to read attachments on the server that they should not have access to. IBM X-Force ID: 179539.

CVE-2020-4413MEDIUMCVSS 5.9EG 5.9

2020-06-24

IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive inform…

CVE-2020-4449HIGHCVSS 7.5EG 7.5

2020-06-05

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181230.

CVE-2020-4452HIGHCVSS 7.5EG 7.5

2020-06-29

IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 181324.

CVE-2020-4477MEDIUMCVSS 6.5EG 6.5

2020-06-15

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779.

CVE-2020-4484MEDIUMCVSS 4.3EG 4.3

2020-11-06

IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could disclose sensitive information to an authenticated user that could be used in further attacks against the system. IBM X-Force ID: 181858.

CVE-2020-4494HIGHCVSS 7.5EG 7.5

2020-06-15

IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 (Linux), 8.1.9.0 through 8.1.9.1 (AIX) web user interfaces could al…

CVE-2020-4498MEDIUMCVSS 4.4EG 4.4

2020-07-27

IBM MQ Appliance 9.1 LTS and 9.1 CD could allow a local privileged user to obtain highly sensitve information due to inclusion of data within trace files. IBM X-Force ID: 182118.

CVE-2020-4528MEDIUMCVSS 5.5EG 5.5

2020-10-06

IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under special conditions, to obtain highly sensitive information from log files. IBM X-Force ID: 182658.

CVE-2020-4532MEDIUMCVSS 5.3EG 5.3

2020-06-17

IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technical error message is …

CVE-2020-4562MEDIUMCVSS 5.3EG 5.3

2021-04-26

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by allowing cross-window communication with unrestricted target origin via documentation frames.

CVE-2020-4565MEDIUMCVSS 5.9EG 5.9

2020-06-26

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being used between the application and server. IBM X-Force ID: 183935.

CVE-2020-4572MEDIUMCVSS 5.3EG 5.3

2020-07-29

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the …

CVE-2020-4573MEDIUMCVSS 5.3EG 5.3

2020-07-29

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests. IBM X-Force ID: 184180.

CVE-2020-4591LOWCVSS 3.3EG 3.3

2020-08-28

IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the second chunk of an object in an encrypted container pool. IBM X-Force ID: 184746.

CVE-2020-4612MEDIUMCVSS 6.5EG 6.5

2020-09-22

IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to obtain sensitive information using a specially crafted HTTP request. IBM X-Force ID: 184924.

CVE-2020-4616MEDIUMCVSS 5.3EG 5.3

2020-09-22

IBM Data Risk Manager (iDNA) 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 184929.

CVE-2020-4625MEDIUMCVSS 5.3EG 5.3

2020-11-30

IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from…

CVE-2020-4626MEDIUMCVSS 4.3EG 4.3

2020-11-30

IBM Cloud Pak for Security 1.3.0.1 (CP4S) could reveal sensitive information about the internal network to an authenticated user using a specially crafted HTTP request. IBM X-Force ID: 185362.

CVE-2020-4640MEDIUMCVSS 4.1EG 4.1

2021-02-04

Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment identifiers. This information can be cached in the intermediate nodes like proxy se…

CVE-2020-4649MEDIUMCVSS 4.3EG 4.3

2020-11-03

IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM1Web user sessions. IBM X-Force ID: 186022.

CVE-2020-4650LOWCVSS 3.3EG 3.3

2020-11-09

IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023.

CVE-2020-4678MEDIUMCVSS 4.9EG 4.9

2020-10-12

IBM Security Guardium 11.2 could allow an attacker with admin access to obtain and read files that they normally would not have access to. IBM X-Force ID: 186423.

CVE-2020-4687MEDIUMCVSS 4.3EG 4.3

2020-08-20

IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force ID: 186679.

CVE-2020-4708MEDIUMCVSS 5.3EG 5.3

2020-09-16

IBM Security Trusteer Pinpoint Detect 11.6.5 could disclose some information due to using a wildcard in the Access-Control-Allow-Origin header. IBM X-Force ID: 187371.

CVE-2020-4732MEDIUMCVSS 6.5EG 6.5

2021-06-02

IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-Force ID: 188126.

CVE-2020-4783MEDIUMCVSS 5.9EG 5.9

2020-11-23

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain …

CVE-2020-4791MEDIUMCVSS 5.3EG 5.3

2021-02-09

IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to obtain sensitive information using main in the middle attacks due to improper certificate validation. IBM X-Force ID: 189379.

CVE-2020-4795HIGHCVSS 8.2EG 8.2

2021-02-09

IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information to an unauthorized user using a specially crafted HTTP request. IBM X-Force ID: 189446.

CVE-2020-4815MEDIUMCVSS 5.3EG 5.3

2021-01-27

IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system.

CVE-2020-4816MEDIUMCVSS 5.9EG 5.9

2021-01-27

IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensit…

CWE-200— Exposure of Sensitive Information to an Unauthorized Actor

CVEs classified under CWE-200page 94 of 174

Map vulnerabilities like CWE-200 to your infrastructure