CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4556 – IBM Financial Transaction Manager information disclosure
https://notcve.org/view.php?id=CVE-2020-4556
IBM Financial Transaction Manager for High Value Payments for Multi-Platform 3.2.0 through 3.2.10 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 183329. • https://exchange.xforce.ibmcloud.com/vulnerabilities/183329 https://www.ibm.com/support/pages/node/6962117 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5026
https://notcve.org/view.php?id=CVE-2020-5026
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 193662. • https://exchange.xforce.ibmcloud.com/vulnerabilities/193662 https://www.ibm.com/support/pages/node/6958504 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-5002 – IBM Financial Transaction Manager security bypass
https://notcve.org/view.php?id=CVE-2020-5002
IBM Financial Transaction Manager 3.2.0 through 3.2.10 could allow an authenticated user to perform unauthorized actions due to improper validation. IBM X-Force ID: 192954. • https://exchange.xforce.ibmcloud.com/vulnerabilities/192954 https://www.ibm.com/support/pages/node/6958504 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-5001 – IBM Financial Transaction Manager path traversal
https://notcve.org/view.php?id=CVE-2020-5001
IBM Financial Transaction Manager 3.2.0 through 3.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 192953. • https://exchange.xforce.ibmcloud.com/vulnerabilities/192953 https://www.ibm.com/support/pages/node/6958504 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-4575
https://notcve.org/view.php?id=CVE-2019-4575
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.9 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 166801. IBM Financial Transaction Manager for Digital Payments for Multi-Platform versiones 3.2.0 hasta 3.2.9, es vulnerable a una inyección SQL. Un atacante remoto podría enviar sentencias SQL especialmente diseñadas, que podrían permitir al atacante visualizar, añadir, modificar o eliminar información en la base de datos del back-end. • https://exchange.xforce.ibmcloud.com/vulnerabilities/166801 https://www.ibm.com/support/pages/node/6594797 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •