CVE-2019-4485

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164069.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
IBM	Contract Management	10.1.0; 10.1.3
IBM	Emptoris Spend Analysis	10.1.0; 10.1.3
IBM	Emptoris Sourcing	10.1.0; 10.1.3

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/164069VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880221Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/164069VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10880221Vendor Advisory

Timeline

Published: Aug 20, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-44865.4IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in CVE-2019-44945.4IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vuln CVE-2019-44955.4IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vuln CVE-2019-44975.4IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vuln CVE-2019-45055.3IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, ca CVE-2019-45087.8IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local attacker. IBM X-Force CVE-2019-45094.3IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obt CVE-2019-45124.3IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks aga CVE-2019-45138.2IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 is vulnerable to an XML External Entity Injection (XXE) attack when processi CVE-2019-45145.3IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unauthorized users. The information can be us CVE-2019-45156.5IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malici CVE-2019-45207.5IBM Security Directory Server 6.4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account cre