CVE-2019-4321

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Water Operations for Waternamics V5.1.0 - V5.2.1.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 161201.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-521

Affected software

Vendor	Product	Versions
IBM	Intelligent Operations Center	5.1.0; 5.1.0.1; 5.1.0.2; 5.1.0.3; 5.1.0.4; 5.1.0.5; 5.1.0.6; 5.1.0.7; 5.1.0.8; 5.1.0.9; 5.1.0.10; 5.1.0.11; 5.1.0.12; 5.1.0.13; 5.1.0.14; 5.2.0

References

http://www.ibm.com/support/docview.wss?uid=ibm10885901Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/161201VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10885901Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/161201VDB Entry, Vendor Advisory

Timeline

Published: Sep 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-43227.8IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could CVE-2019-43234.3"HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of un CVE-2019-43246.1"HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy."CVE-2019-43255.3"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."CVE-2019-43267.5"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Securit CVE-2019-43277.5"HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypte CVE-2019-43294.3IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass CVE-2019-43304.3IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause CVE-2019-43344.3IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against CVE-2019-43355.5IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user. IBM X-Force ID: 1 CVE-2019-43369.8IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to CVE-2019-43375.3IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentica