Sterling Partner Engagement Manager vulnerabilities
9 known vulnerabilities in Sterling Partner Engagement Manager from IBM. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Sterling Partner Engagement Manager: Generation of Error Message Containing Sensitive Information
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks aga
- 7.5 High severity
Sterling Partner Engagement Manager: Use of a Key Past its Expiration Date
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token
- 7.5 High severity
Sterling Partner Engagement Manager: Cleartext Transmission of Sensitive Information
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.
- 7.5 High severity
Sterling Partner Engagement Manager: Missing Authentication for Critical Functionality
IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896.
- 9.8 Critical severity
Sterling Partner Engagement Manager: Improper Neutralization of Special Elements used in an SQL Command
IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X
- 7.1 High severity
Partner Engagement Manager: Improper Restriction of XML External Entity Reference
IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID:
- 8.8 High severity
Sterling Partner Engagement Manager: Improper Neutralization of Special Elements in Output Used by a Downstream Component
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting
- 7.1 High severity
Sterling Partner Engagement Manager: Improper Restriction of XML External Entity Reference
IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memor
- 7.5 High severity
Sterling Partner Engagement Manager: Operation on a Resource after Expiration or Release
IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131.