Ibm Openpages Grc Platform vulnerabilities
22 known vulnerabilities affecting ibm/openpages_grc_platform.
Total CVEs
22
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM18LOW3
Vulnerabilities
Page 1 of 2
CVE-2024-27257MEDIUMCVSS 4.3≥ 8.3, < 8.3.0.22024-09-10
CVE-2024-27257 [MEDIUM] CWE-540 CVE-2024-27257: IBM OpenPages 8.3 and 9.0 potentially exposes information about client-side source code through use
IBM OpenPages 8.3 and 9.0 potentially exposes information about client-side source code through use of JavaScript source maps to unauthorized users.
nvd
CVE-2024-35151MEDIUMCVSS 6.5v8.32024-08-22
CVE-2024-35151 [MEDIUM] CWE-288 CVE-2024-35151: IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive informatio
IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs.
nvd
CVE-2020-4536MEDIUMCVSS 4.3≥ 8.0.0.0, < 8.1.0.2v8.12021-05-11
CVE-2020-4536 [MEDIUM] CWE-209 CVE-2020-4536: IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a
IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182907.
cvelistv5nvd
CVE-2020-4535MEDIUMCVSS 5.4≥ 8.0.0.0, < 8.1.0.2v8.12021-05-11
CVE-2020-4535 [MEDIUM] CWE-79 CVE-2020-4535: IBM OpenPages GRC Platform 8.1 is vulnerable to cross-site scripting. This vulnerability allows user
IBM OpenPages GRC Platform 8.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182906.
cvelistv5nvd
CVE-2017-1679MEDIUMCVSS 5.5v7.2.0.0v7.3.0.0+6 more2018-09-10
CVE-2017-1679 [MEDIUM] CWE-200 CVE-2017-1679: IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allow an attacker to obtain sensitive inform
IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allow an attacker to obtain sensitive information from error log files. IBM X-Force ID: 134001.
cvelistv5nvd
CVE-2016-0234LOWCVSS 3.3≥ 7.1.0.0, ≤ 7.1.0.3≥ 7.2.0.0, ≤ 7.2.0.2+4 more2018-08-30
CVE-2016-0234 [MEDIUM] CWE-613 CVE-2016-0234: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive informatio
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neglected to close their browser. IBM X-Force ID: 110303.
cvelistv5nvd
CVE-2017-1300HIGHCVSS 8.8v7.1.0.0v7.1.0.1+11 more2017-11-01
CVE-2017-1300 [HIGH] CWE-352 CVE-2017-1300: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site request forgery which could
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 125162.
cvelistv5nvd
CVE-2017-1148MEDIUMCVSS 5.3v7.1.0.0v7.1.0.1+10 more2017-11-01
CVE-2017-1148 [MEDIUM] CWE-200 CVE-2017-1148: IBM OpenPages GRC Platform 7.2 and 7.3 with OpenPages Loss Event Entry (LEE) application could allow
IBM OpenPages GRC Platform 7.2 and 7.3 with OpenPages Loss Event Entry (LEE) application could allow a user to obtain sensitive information including private APIs that could be used in further attacks against the system. IBM X-Force ID: 122201.
cvelistv5nvd
CVE-2017-1290MEDIUMCVSS 5.4v7.1.0.0v7.1.0.1+11 more2017-11-01
CVE-2017-1290 [MEDIUM] CWE-79 CVE-2017-1290: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerabili
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125151.
cvelistv5nvd
CVE-2017-1147MEDIUMCVSS 5.4v7.1.0.0v7.1.0.1+11 more2017-11-01
CVE-2017-1147 [MEDIUM] CWE-79 CVE-2017-1147: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerabili
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 122200.
cvelistv5nvd
CVE-2016-3048MEDIUMCVSS 5.4v7.1.0.0v7.1.0.1+11 more2017-11-01
CVE-2016-3048 [MEDIUM] CWE-79 CVE-2016-3048: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerabili
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 114711.
cvelistv5nvd
CVE-2017-1333MEDIUMCVSS 5.3v7.1.0.0v7.1.0.1+11 more2017-11-01
CVE-2017-1333 [MEDIUM] CWE-200 CVE-2017-1333: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow an unauthenticated user to obtain sensitive
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow an unauthenticated user to obtain sensitive information about the server that could be used in future attacks against the system. IBM X-Force ID: 126241.
cvelistv5nvd
CVE-2016-3049MEDIUMCVSS 5.4v7.1v7.2+1 more2017-10-24
CVE-2016-3049 [MEDIUM] CWE-79 CVE-2016-3049: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker coul
IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712.
nvd
CVE-2015-5049MEDIUMCVSS 5.4v7.0.0.0v7.0.0.1+5 more2016-01-01
CVE-2015-5049 [MEDIUM] CWE-89 CVE-2015-5049: SQL injection vulnerability in the API in IBM OpenPages GRC Platform 7.0 before 7.0.0.4 IF3 and 7.1
SQL injection vulnerability in the API in IBM OpenPages GRC Platform 7.0 before 7.0.0.4 IF3 and 7.1 before 7.1.0.1 IF6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
nvd
CVE-2015-0142MEDIUMCVSS 4.0v6.2.0.0v6.2.1.0+3 more2015-10-03
CVE-2015-0142 [MEDIUM] CWE-264 CVE-2015-0142: IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before
IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-mode transition and data-storage outage) by calling the System Administration Mode function.
nvd
CVE-2015-0141MEDIUMCVSS 4.0v6.2.0.0v6.2.1.0+3 more2015-10-03
CVE-2015-0141 [MEDIUM] CWE-284 CVE-2015-0141: IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before
IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to modify arbitrary user filters via a JSON request.
nvd
CVE-2015-0143MEDIUMCVSS 4.0v6.2.0.0v6.2.1.0+3 more2015-10-03
CVE-2015-0143 [MEDIUM] CWE-200 CVE-2015-0143: IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before
IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading error messages.
nvd
CVE-2015-0145MEDIUMCVSS 6.8v6.2.0.0v6.2.1.0+3 more2015-10-03
CVE-2015-0145 [MEDIUM] CWE-352 CVE-2015-0145: Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1
Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
nvd
CVE-2014-8916LOWCVSS 3.5v6.2.0.0v6.2.1.0+3 more2015-10-03
CVE-2014-8916 [LOW] CWE-79 CVE-2014-8916: Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before
Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0144.
nvd
CVE-2015-0144LOWCVSS 3.5v6.2.0.0v6.2.1.0+3 more2015-10-03
CVE-2015-0144 [LOW] CVE-2015-0144: Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before
Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8916.
nvd
1 / 2Next →