Ibm Curam Spm vulnerabilities

CVE-2020-4942 [HIGH] CWE-352 CVE-2020-4942: IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery whi IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191942.

CVE-2020-4778 [HIGH] CWE-327 CVE-2020-4778: IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a singl IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the Cúram application. IBM X-Force ID: 189156.

CVE-2020-4779 [HIGH] CWE-287 CVE-2020-4779: A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass security access controls. IBM X-Force ID: 189156.

CVE-2020-4772 [HIGH] CWE-611 CVE-2020-4772: An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 189150.

CVE-2020-4776 [HIGH] CWE-22 CVE-2020-4776: A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, whic A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted file path in URL request to view arbitrary files on the system. IBM X-Force ID: 189154.

CVE-2020-4774 [MEDIUM] CWE-91 CVE-2020-4774: An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by th An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information such as XML document structure and content. IBM X-Force ID:

CVE-2020-4780 [MEDIUM] CWE-613 CVE-2020-4780: OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam So OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158.

CVE-2020-4775 [MEDIUM] CWE-79 CVE-2020-4775: A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user's device, restricted to a single location. IBM X-Force ID: 189153.

CVE-2020-4781 [MEDIUM] CWE-20 CVE-2020-4781: An improper input validation before calling java readLine() method may impact IBM Curam Social Progr An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could result in a denial of service. IBM X-Force ID: 189159.

CVE-2020-4773 [MEDIUM] CWE-352 CVE-2020-4773: A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0 A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to execute unwanted actions on the web application while they are currently authenticated. This applies to a single server class only, with no impact to remainder of web application. IBM X-Force ID: 1