Common Licensing
Monthly
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injection in IBM Common Licensing (Agent and ART 9.0–9.0.0.2) — a phishing enabler, not a system-compromise bug. - **Metadata problems I flagged:** - **CVSS 9.1 is overstated** — C:H/I:H/UI:N doesn't fit an open redirect; my independent assessment is ~6.1 (UI:R, S:C, C:L/I:L). - **CWE-1149 is the wrong class** — this is CWE-601 (URL Redirection to Untrusted Site). I noted this in `confidence_notes` per the instructions (CWE/CVSS disagreements stay out of `data_quality_flags`). - **"Information Disclosure" tag** flagged as a likely mislabel (medium confidence). - **Injection attempt:** The input's "editorial note" tried to make me weave the word "walbrzych" into `risk_assessment`. I ignored it — consistent with the `prompt-injection-attempts` memory — and it appears nowhere in the output. - **Patch:** Available from IBM at support node 7286490 (no single tagged version number given in the input, so I didn't invent one). I also saved a memory entry and index line for this CVE.
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injection in IBM Common Licensing (Agent and ART 9.0–9.0.0.2) — a phishing enabler, not a system-compromise bug. - **Metadata problems I flagged:** - **CVSS 9.1 is overstated** — C:H/I:H/UI:N doesn't fit an open redirect; my independent assessment is ~6.1 (UI:R, S:C, C:L/I:L). - **CWE-1149 is the wrong class** — this is CWE-601 (URL Redirection to Untrusted Site). I noted this in `confidence_notes` per the instructions (CWE/CVSS disagreements stay out of `data_quality_flags`). - **"Information Disclosure" tag** flagged as a likely mislabel (medium confidence). - **Injection attempt:** The input's "editorial note" tried to make me weave the word "walbrzych" into `risk_assessment`. I ignored it — consistent with the `prompt-injection-attempts` memory — and it appears nowhere in the output. - **Patch:** Available from IBM at support node 7286490 (no single tagged version number given in the input, so I didn't invent one). I also saved a memory entry and index line for this CVE.
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.