Ibm Partner Engagement Manager vulnerabilities

11 known vulnerabilities affecting ibm/partner_engagement_manager.

Total CVEs

11

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL1HIGH5MEDIUM4LOW1

Vulnerabilities

Page 1 of 1

CVE-2022-34354LOWCVSS 3.3v6.1.2v6.2.0+2 more2022-11-16

CVE-2022-34354 [MEDIUM] CWE-922 CVE-2022-34354: IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored lo IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424.

CVE-2022-34348HIGHCVSS 7.1v6.12022-09-23

CVE-2022-34348 [HIGH] CWE-611 CVE-2022-34348: IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 230017.

CVE-2022-22358HIGHCVSS 7.1≥ 6.1.2, < 6.1.2.5≥ 6.2.0, < 6.2.0.32022-07-19

CVE-2022-22358 [HIGH] CWE-611 CVE-2022-22358: IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML Exte IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651.

CVE-2022-22360HIGHCVSS 8.8≥ 6.1.2, < 6.1.2.5≥ 6.2.0, < 6.2.0.32022-07-19

CVE-2022-22360 [HIGH] CWE-74 CVE-2022-22360: IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authent IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM X-Force ID: 220782.

CVE-2022-22417MEDIUMCVSS 5.4≥ 6.1.2, < 6.1.2.5≥ 6.2.0, < 6.2.0.32022-07-19

CVE-2022-22417 [MEDIUM] CWE-79 CVE-2022-22417: IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 223127.

CVE-2022-22359MEDIUMCVSS 6.5≥ 6.1.2, < 6.1.2.5≥ 6.2.0, < 6.2.0.32022-07-19

CVE-2022-22359 [MEDIUM] CWE-352 CVE-2022-22359: IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652.

CVE-2022-22416MEDIUMCVSS 5.4≥ 6.1.2, < 6.1.2.5≥ 6.2.0, < 6.2.0.32022-07-19

CVE-2022-22416 [MEDIUM] CWE-918 CVE-2022-22416: IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 223126.

CVE-2022-22332HIGHCVSS 7.5v6.2.02022-04-01

CVE-2022-22332 [HIGH] CWE-672 CVE-2022-22332: IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user du IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131.

CVE-2022-22331HIGHCVSS 7.1v6.2.02022-04-01

CVE-2022-22331 [HIGH] CWE-639 CVE-2022-22331: IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain s IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability (IDOR). IBM X-Force ID: 219130.

CVE-2022-22328MEDIUMCVSS 6.2v6.2.02022-04-01

CVE-2022-22328 [MEDIUM] CVE-2022-22328: IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privilege IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to another users data. IBM X-Force ID: 218871.

CVE-2021-29781CRITICALCVSS 9.8v2.02021-07-30

CVE-2021-29781 [CRITICAL] CWE-502 CVE-2021-29781: IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the sy IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 203091.