Financial Transaction Manager
Monthly
Sensitive information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stems from the product's use of a hard-coded or predictable cryptographic key (CWE-321). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), an unauthenticated remote attacker who obtains that static key can read data the product intended to protect, with no integrity or availability impact. The real gate is acquiring or deriving the embedded key rather than defeating authentication: no public exploit identified at time of analysis, EPSS is only 0.26% (17th percentile), and CISA SSVC records exploitation as none with Automatable set to no, making this a moderate, not urgent, priority.
Hard-coded cryptographic keys and initialization vectors in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote authenticated attacker (CVSS 3.1 PR:L, 7.1 overall) to decrypt protected sensitive information and forge authentication tags, because the same static key material is baked into every deployment rather than generated per installation. Affected builds are the OpenShift-packaged FTM at 4.0.6.0 (including Interim Fixes 1 through 6) and, per ENISA EUVD, the 4.0.7.0 through 4.0.10.0 Interim Fix 06 range; the decisive prerequisite is compromise of a low-privilege account, and impact is primarily confidentiality with only partial integrity (C:H/I:L/A:N) and no availability loss. Exploitation is currently assessed as none - no public exploit code identified at time of analysis, EPSS only 0.22% (13th percentile), CISA SSVC exploitation "none", automatable "no" - which makes this a moderate-severity, lower-priority issue in practice.
Message forgery in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets remote, unauthenticated attackers send messages bearing forged cryptographic signatures that the platform improperly accepts as authentic, undermining the integrity of trusted transaction messaging (CWE-347, CVSS 7.5, integrity-only impact with no confidentiality or availability loss). Affected releases are the 4.0.6.0 line, including Interim Fixes 1 through 6, plus 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 06. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N) but demands that an attacker understand and correctly craft a message in FTM's expected format and that an FTM message interface be reachable; there is no public exploit identified at time of analysis (EPSS 0.19%, 9th percentile), CISA SSVC rates exploitation as none and automatable as no, and there is no KEV listing.
Remote code execution via ESQL command injection affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where externally supplied input is combined into ESQL statements without neutralization of special elements. Per IBM PSIRT scoring (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), an unauthenticated remote attacker who can reach a vulnerable FTM message flow that builds ESQL commands from attacker-controlled data can achieve full confidentiality, integrity, and availability impact within the FTM runtime and its connected resources. The high attack-complexity rating reflects a non-default precondition - typically a specific flow or configuration that routes untrusted data into ESQL - so exposure is limited to environments running FTM on OpenShift with such a flow. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift exposes transaction data, credentials, or other confidential payloads to anyone able to observe network traffic on the same segment. The issue affects deployments of FTM for OpenShift where the relevant transport is not wrapped in TLS; an unauthenticated attacker with an adjacent-network position (per the assessed vector PR:N, AV:A) can passively capture that traffic, though a successful capture depends on the specific unencrypted channel being in use (AC:H), which is why the independently assessed impact is limited to confidentiality only. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation, so this remains a low-real-world-priority issue despite the headline 7.5 (High) CVSS score.
Authenticated remote users of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can forge entries in the transaction audit log by supplying a crafted HTTP header that the application fails to validate properly. Successful abuse requires only valid low-privilege credentials (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the practical consequence is limited to the integrity of the audit trail - no data disclosure, no service disruption, and no unauthenticated attack path. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided; combined with the narrow, specialized deployment footprint of the platform, this is a genuinely low-priority issue whose signals are consistent rather than conflicting.
Improper authorization controls in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let an authenticated, low-privilege user forge identities and act as another user across the network, bypassing the platform's security checks. Only integrity is affected - an attacker can perform unauthorized actions under a spoofed identity, but there is no exposure of confidential data and no denial-of-service impact, and a valid account on the FTM instance is a prerequisite (PR:L, so the flaw is not exploitable pre-authentication). No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; with a CVSS base of 6.5 and a narrow deployment footprint in financial transaction environments, it is a genuine but moderate-priority issue.
In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN messages are assumed to be immutable. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting in a denial of service on displaying or. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information (e.g. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.1.0 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.0, 3.0.2, and 3.0.5 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable to SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive product configuration information from log files. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.6 could allow an authenticated user to execute a specially crafted command that could obtain sensitive information. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command that could obtain sensitive information. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command that could cause a denial of service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive information from an undocumented URL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.0.x is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Financial Transaction Manager (FTM) for ACH Services 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002 allows remote authenticated users. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Payments Director in IBM Financial Transaction Manager (FTM) for ACH Services, Check Services, and Corporate Payment Services (CPS) 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002 allows remote. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity.
IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 does not properly enforce operator-intervention requirements, which allows remote authenticated users to bypass. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allow remote authenticated. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site request forgery (CSRF) vulnerability in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allows remote attackers to hijack the authentication of arbitrary. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sensitive information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stems from the product's use of a hard-coded or predictable cryptographic key (CWE-321). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), an unauthenticated remote attacker who obtains that static key can read data the product intended to protect, with no integrity or availability impact. The real gate is acquiring or deriving the embedded key rather than defeating authentication: no public exploit identified at time of analysis, EPSS is only 0.26% (17th percentile), and CISA SSVC records exploitation as none with Automatable set to no, making this a moderate, not urgent, priority.
Hard-coded cryptographic keys and initialization vectors in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote authenticated attacker (CVSS 3.1 PR:L, 7.1 overall) to decrypt protected sensitive information and forge authentication tags, because the same static key material is baked into every deployment rather than generated per installation. Affected builds are the OpenShift-packaged FTM at 4.0.6.0 (including Interim Fixes 1 through 6) and, per ENISA EUVD, the 4.0.7.0 through 4.0.10.0 Interim Fix 06 range; the decisive prerequisite is compromise of a low-privilege account, and impact is primarily confidentiality with only partial integrity (C:H/I:L/A:N) and no availability loss. Exploitation is currently assessed as none - no public exploit code identified at time of analysis, EPSS only 0.22% (13th percentile), CISA SSVC exploitation "none", automatable "no" - which makes this a moderate-severity, lower-priority issue in practice.
Message forgery in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets remote, unauthenticated attackers send messages bearing forged cryptographic signatures that the platform improperly accepts as authentic, undermining the integrity of trusted transaction messaging (CWE-347, CVSS 7.5, integrity-only impact with no confidentiality or availability loss). Affected releases are the 4.0.6.0 line, including Interim Fixes 1 through 6, plus 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 06. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N) but demands that an attacker understand and correctly craft a message in FTM's expected format and that an FTM message interface be reachable; there is no public exploit identified at time of analysis (EPSS 0.19%, 9th percentile), CISA SSVC rates exploitation as none and automatable as no, and there is no KEV listing.
Remote code execution via ESQL command injection affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where externally supplied input is combined into ESQL statements without neutralization of special elements. Per IBM PSIRT scoring (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), an unauthenticated remote attacker who can reach a vulnerable FTM message flow that builds ESQL commands from attacker-controlled data can achieve full confidentiality, integrity, and availability impact within the FTM runtime and its connected resources. The high attack-complexity rating reflects a non-default precondition - typically a specific flow or configuration that routes untrusted data into ESQL - so exposure is limited to environments running FTM on OpenShift with such a flow. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift exposes transaction data, credentials, or other confidential payloads to anyone able to observe network traffic on the same segment. The issue affects deployments of FTM for OpenShift where the relevant transport is not wrapped in TLS; an unauthenticated attacker with an adjacent-network position (per the assessed vector PR:N, AV:A) can passively capture that traffic, though a successful capture depends on the specific unencrypted channel being in use (AC:H), which is why the independently assessed impact is limited to confidentiality only. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation, so this remains a low-real-world-priority issue despite the headline 7.5 (High) CVSS score.
Authenticated remote users of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can forge entries in the transaction audit log by supplying a crafted HTTP header that the application fails to validate properly. Successful abuse requires only valid low-privilege credentials (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the practical consequence is limited to the integrity of the audit trail - no data disclosure, no service disruption, and no unauthenticated attack path. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided; combined with the narrow, specialized deployment footprint of the platform, this is a genuinely low-priority issue whose signals are consistent rather than conflicting.
Improper authorization controls in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let an authenticated, low-privilege user forge identities and act as another user across the network, bypassing the platform's security checks. Only integrity is affected - an attacker can perform unauthorized actions under a spoofed identity, but there is no exposure of confidential data and no denial-of-service impact, and a valid account on the FTM instance is a prerequisite (PR:L, so the flaw is not exploitable pre-authentication). No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; with a CVSS base of 6.5 and a narrow deployment footprint in financial transaction environments, it is a genuine but moderate-priority issue.
In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN messages are assumed to be immutable. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting in a denial of service on displaying or. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information (e.g. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.1.0 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.0, 3.0.2, and 3.0.5 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable to SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive product configuration information from log files. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.6 could allow an authenticated user to execute a specially crafted command that could obtain sensitive information. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command that could obtain sensitive information. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command that could cause a denial of service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive information from an undocumented URL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.0.x is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Cross-site scripting (XSS) vulnerability in the Web UI in IBM Financial Transaction Manager (FTM) for ACH Services 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002 allows remote authenticated users. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Payments Director in IBM Financial Transaction Manager (FTM) for ACH Services, Check Services, and Corporate Payment Services (CPS) 3.0.0.x before fp0015 and 3.0.1.0 before iFix0002 allows remote. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity.
IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 does not properly enforce operator-intervention requirements, which allows remote authenticated users to bypass. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in configuration-details screens in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allow remote authenticated. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site request forgery (CSRF) vulnerability in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 allows remote attackers to hijack the authentication of arbitrary. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 before 2.0.0.3 and 2.1 before 2.1.0.1 allows remote. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.