CVE Vulnerability Catalog

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift uses hard-coded cryptographic keys and initialization vectors. As a result, a remote authenticated attacker could obtain sensitive information and forge authentication tags.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to path traversal. A remote authenticated attacker could modify server files as a result.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift does not properly enforce authorization. A remote authenticated attacker could perform unauthorized payment mutation actions as a result.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift stores credentials with insufficient protection. A local attacker could obtain sensitive information as a result.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift performs improper path canonicalization. A remote attacker could read arbitrary files as a result.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift transmits sensitive or security-critical data in cleartext over a communication channel that can be sniffed by unauthorized actors.

IBM Concert does not properly enforce storage limits. A remote authenticated attacker could cause a denial of service as a result.

IBM Concert is vulnerable to server-side request forgery (SSRF). An authenticated attacker may send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

IBM Concert recursively copies build context directories into container images. A local attacker could obtain sensitive information as a result.

IBM Concert uses weaker than expected cryptographic algorithms. An attacker could decrypt highly sensitive information as a result.

IBM Concert versions 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.

e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and controller navigation links, allowing attackers to redirect pagination and navigation controls to attacker-controlled origins. Attackers can supply host, protocol, and port query parameters that are interpreted as URL generation options, causing pagination links to point to malicious domains while the initial page loads from the legitimate site.

ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding.