CVE-2019-4308

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
IBM	Emptoris Sourcing	10.1.0; 10.1.3
IBM	Contract Management	10.1.0; 10.1.3
IBM	Emptoris Spend Analysis	10.1.0; 10.1.3

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/161034VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880221Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/161034VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880221Vendor Advisory

Timeline

Published: Aug 20, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-43095.5IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses hard coded credentials which could allow a local user to obtain highly sensiti CVE-2019-43107.5IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to br CVE-2019-43115.3IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users. The information can be used CVE-2019-43147.5IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores sensitive information in cleartext within a resource that might be accessibl CVE-2019-43217.5IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Wat CVE-2019-43227.8IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could CVE-2019-43234.3"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of un CVE-2019-43246.1"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."CVE-2019-43255.3"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."CVE-2019-43267.5"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Securit CVE-2019-43277.5"HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypte CVE-2019-43294.3IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass