Skip to content
OpenAdvisories
Medium 1 exploited CVE WID-SEC-2026-3721 18 CVEs

IBM QRadar SIEM: Mehrere Schwachstellen

Published May 4, 2021 · Updated Oct 4, 2026 · Revision 2 · de-DE

Vendor: IBM Product: QRadar SIEM Platform: Linux

Summary

Ein entfernter, anonymer, authentifizierter, lokaler oder benachbarter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder einen Denial of Service Zustand auszulösen.

Product

IBM QRadar Security Information and Event Management (SIEM) bietet Unterstützung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.

Vulnerabilities 18

  • Medium 6.9
    CVE-2020-11023 Exploited Public exploit EPSS 85%

    Potential XSS vulnerability in jQuery

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

    jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems
    KEV Jan 23, 2025
  • Critical 9.8
    CVE-2019-17195 Public exploit EPSS 11%

    Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT

    Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

    com.nimbusds:nimbus-jose-jwt Maven
  • High 8.8
    CVE-2015-5237

    protobuf susceptible to buffer overflow

    protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

    protobuf protobuf protobuf google/protobuf Debian Ubuntu Packagist Maven PyPI Go NuGet
  • High 7.5
    CVE-2017-18640 EPSS 27%

    SnakeYAML Entity Expansion during load operation

    The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

    org.yaml:snakeyaml snakeyaml snakeyaml Debian Ubuntu Maven
  • High 7.5
    CVE-2020-4979

    IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to compr…

    IBM QRadar SIEM
  • High 7.1
    CVE-2020-5013

    IBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A …

    IBM QRadar SIEM
  • Medium 6.9
    CVE-2020-11022 Public exploit EPSS 99%

    jQuery has a potential XSS vulnerability

    In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…

    jquery jQuery keycloak-26.6-iamguarded-compat drupal7 Debian Ubuntu Alpine Wolfi npm Packagist Maven NuGet RubyGems
  • Medium 6.2
    CVE-2020-4932

    IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for…

    IBM QRadar SIEM
  • Medium 6.1
    CVE-2012-6708 Public exploit

    Cross-Site Scripting in jquery

    jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<…

    ruby ceph jquery-rails org.webjars.npm:jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems
  • Medium 6.1
    CVE-2015-9251 Public exploit EPSS 30%

    Cross-Site Scripting (XSS) in jquery

    jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

    ruby ceph jquery-rails jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems
  • Medium 6.1
    CVE-2021-20397

    IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…

    IBM QRadar SIEM
  • Medium 5.9
    CVE-2021-20401

    IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for…

    IBM QRadar SIEM
  • Medium 5.4
    CVE-2020-4929

    IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…

    IBM QRadar SIEM
  • Medium 4.9
    CVE-2020-4993

    IBM QRadar SIEM 7.3 and 7.4 when decompressing or verifying signature of zip files processes data in a way that may be …

    IBM QRadar SIEM
  • Medium 4.4
    CVE-2020-15250

    Information disclosure in JUnit4

    In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files a…

    junit-team junit4 junit4 junit4 Debian Ubuntu Azure Linux Alpine Maven
  • Medium 4.3
    CVE-2020-13943 EPSS 53%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent re…

    tomcat9 org.apache.tomcat:tomcat-coyote Debian Maven
  • Medium 4.3
    CVE-2020-4883

    IBM QRadar SIEM 7.3 and 7.4 could disclose sensitive information about other domains which could be used in further att…

    IBM QRadar SIEM
  • Medium —
    CVE-2011-4969 EPSS 19%

    jQuery vulnerable to Cross-Site Scripting (XSS)

    Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

    jquery-rails org.webjars.npm:jquery jQuery jquery Azure Linux npm Maven NuGet RubyGems

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References