Engineering Ai Hub
Monthly
Cross-site scripting in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 enables remote attackers to inject and execute arbitrary script code within a victim's browser session through unsanitized input that is rendered during web page generation. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms remote, unauthenticated exploitability contingent on victim interaction, consistent with reflected or stored XSS. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via its support portal.
Stored/reflected cross-site scripting in IBM Engineering AI Hub 1.0.0 through 1.2.0 lets a remote unauthenticated attacker inject arbitrary scripts into generated web pages that execute in a victim's authenticated browser session. Because the CVSS scope is marked changed (S:C), successful exploitation can impact resources beyond the vulnerable component - such as the user's session with adjacent applications. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 expose an open redirect flaw (CWE-601) that enables remote attackers to silently redirect authenticated or unauthenticated users to arbitrary attacker-controlled websites by supplying a crafted URL. The vulnerability requires no privileges but does require user interaction, making it a phishing-enablement risk rather than a direct system compromise vector. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7279964.
Sensitive information disclosure in IBM Engineering AI Hub 1.0.0 through 1.2.0 allows remote attackers to harvest session tokens that the application places directly in URLs, enabling session hijacking and account takeover. IBM (the reporting vendor) has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. The CWE-598 root cause means tokens leak passively into browser history, referer headers, proxy and server access logs rather than requiring an active attack against the server.
Cross-site scripting in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 enables remote attackers to inject and execute arbitrary script code within a victim's browser session through unsanitized input that is rendered during web page generation. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms remote, unauthenticated exploitability contingent on victim interaction, consistent with reflected or stored XSS. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via its support portal.
Stored/reflected cross-site scripting in IBM Engineering AI Hub 1.0.0 through 1.2.0 lets a remote unauthenticated attacker inject arbitrary scripts into generated web pages that execute in a victim's authenticated browser session. Because the CVSS scope is marked changed (S:C), successful exploitation can impact resources beyond the vulnerable component - such as the user's session with adjacent applications. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 expose an open redirect flaw (CWE-601) that enables remote attackers to silently redirect authenticated or unauthenticated users to arbitrary attacker-controlled websites by supplying a crafted URL. The vulnerability requires no privileges but does require user interaction, making it a phishing-enablement risk rather than a direct system compromise vector. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7279964.
Sensitive information disclosure in IBM Engineering AI Hub 1.0.0 through 1.2.0 allows remote attackers to harvest session tokens that the application places directly in URLs, enabling session hijacking and account takeover. IBM (the reporting vendor) has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV. The CWE-598 root cause means tokens leak passively into browser history, referer headers, proxy and server access logs rather than requiring an active attack against the server.