CVE-2019-4193

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-force ID: 159032.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	Jazz for Service Management	1.1.3; 1.1.3.2

References

http://www.ibm.com/support/docview.wss?uid=ibm10885985Patch, Vendor Advisory
http://www.securityfocus.com/bid/109144Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/159032VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10885985Patch, Vendor Advisory
http://www.securityfocus.com/bid/109144Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/159032VDB Entry, Vendor Advisory

Timeline

Published: Jul 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-41944.3IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete autho CVE-2019-42016.1IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirec CVE-2019-420210.0IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can ru CVE-2019-42039.8IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and pot CVE-2019-42045.4IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows CVE-2019-42073.3IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in fur CVE-2019-42087.1IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A CVE-2019-42096.1HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing att CVE-2019-42108.1IBM QRadar SIEM 7.3.2 could allow a user to bypass authentication exposing certain functionality which could lead to information disclosure CVE-2019-42115.4IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2019-42128.8IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized CVE-2019-42143.7IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow