IBM Cics Tx

IBM CICS TX Local RCE via DNS gethostbyname (10.1/11.1)
CVE-2025-1330 7.8 - High - May 08, 2025

IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1  could allow a local user to execute arbitrary code on the system due to failure to handle DNS return requests by the gethostbyname function.

Memory Corruption

IBM CICS TX 10.1/11.1 Local Exec via unsafe gets()
CVE-2025-1331 7.8 - High - May 08, 2025

IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to the use of unsafe use of the gets function.

Use of Inherently Dangerous Function

IBM CICS TX Local Arbitrary Code Exec via gethostbyaddr (S11.1 / A10.1/11.1)
CVE-2025-1329 7.8 - High - May 08, 2025

IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS return requests by the gethostbyaddr function.

Memory Corruption

IBM CICS TX Advanced XSS in Web UI v10.1/11.1 Stored XSS
CVE-2024-41746 6.1 - Medium - January 16, 2025

IBM CICS TX Advanced 10.1, 11.1, and Standard 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

XSS

IBM CICS TX Standard 11.1 CSRF Vulnerability
CVE-2024-41744 8.8 - High - November 01, 2024

IBM CICS TX Standard 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

IBM CICS TX Standard: Cross-Site Scripting Vulnerability in Web UI
CVE-2024-41745 6.1 - Medium - November 01, 2024

IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

XSS

IBM CICS TX Advanced 10.1 XSS in Web UI
CVE-2023-38360 6.1 - Medium - March 04, 2024

IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260769.

XSS

IBM CICS TX Advanced 10.1 Remote Info Disclosure via HTTP Response Discrepancy
CVE-2023-38362 5.3 - Medium - March 04, 2024

IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814.

Side Channel Attack

IBM CICS TX Standard & Advanced 11.1 Weak Crypto Allows Decrypt
CVE-2022-34309 7.5 - High - February 12, 2024

IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229440.

Use of a Broken or Risky Cryptographic Algorithm

IBM CICS TX 11.1 Session Hijack via Web Credentials (CVE-2022-34311)
CVE-2022-34311 4.3 - Medium - February 12, 2024

IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the user's session due to insufficiently protected credentials. IBM X-Force ID: 229446.

Insufficiently Protected Credentials

IBM CICS TX 11.1 Weak Crypto Enables Decryption Attack
CVE-2022-34310 7.5 - High - February 12, 2024

IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229441.

Use of a Broken or Risky Cryptographic Algorithm

CICS XSS in Web UI (Standard 11.1, Advanced 10.1, TXSeries 8.1-9.1)
CVE-2023-42029 5.4 - Medium - November 03, 2023

IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 266059.

XSS

IBM GSKit-Crypto Timing Side-Channel RSA Decryption Leak
CVE-2023-33850 7.5 - High - August 22, 2023

IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information.

Side Channel Attack

CICS TX 11.1 Remote Click Hijack Vulnerability
CVE-2022-34318 6.1 - Medium - December 12, 2022

IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 229461.

Clickjacking

IBM CICS TX 11.1 XSS in Web UI (CVE-2022-34317)
CVE-2022-34317 5.4 - Medium - November 14, 2022

IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229459.

XSS

IBM CICS TX 11.1 Crypto Weakness Enables Decrypting Sensitive Data
CVE-2022-34320 7.5 - High - November 14, 2022

IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229464.

Use of a Broken or Risky Cryptographic Algorithm

IBM CICS TX 11.1 Local Info Disclosure via Insecure Permissions
CVE-2022-34314 3.3 - Low - November 14, 2022

IBM CICS TX 11.1 could disclose sensitive information to a local user due to insecure permission settings. IBM X-Force ID: 229450.

Incorrect Permission Assignment for Critical Resource

IBM CICS TX 11.1 XSS Vulnerability (Arbitrary JS in Web UI)
CVE-2022-34315 5.4 - Medium - November 14, 2022

IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229451.

XSS

IBM CICS TX 11.1 XSS via HTTP header parsing
CVE-2022-34316 5.3 - Medium - November 14, 2022

IBM CICS TX 11.1 does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers. IBM X-Force ID: 229452.

Output Sanitization

IBM CICS TX 11.7 Information Disclosure via HTTP Response Headers
CVE-2022-34329 5.3 - Medium - November 14, 2022

IBM CICS TX 11.7 could allow an attacker to obtain sensitive information from HTTP response headers. IBM X-Force ID: 229467.

IBM CICS TX 11.7 Crypto Weakness: Allow Decrypt Attacks
CVE-2022-34319 7.5 - High - November 14, 2022

IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229463.

Use of a Broken or Risky Cryptographic Algorithm

IBM CICS TX 11.1 insecure cookie attributes enable session hijacking
CVE-2022-34313 3.1 - Low - November 14, 2022

IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. X-Force ID: 229449.

IBM CICS TX 11.1 LFI via Locally Stored Web Pages
CVE-2022-34312 3.3 - Low - November 14, 2022

IBM CICS TX 11.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 229447.

Insecure Storage of Sensitive Information

IBM CICS TX 11.1 Reverse Tabnabbing: Remote Security Bypass
CVE-2022-38705 6.1 - Medium - November 14, 2022

IBM CICS TX 11.1 Standard and Advanced could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a victim to a phishing site. IBM X-Force ID: 234172.

IBM CICS TX 11.1 Local User DOS via Improper Load Handling
CVE-2022-34308 5.5 - Medium - October 07, 2022

IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437.

Allocation of Resources Without Limits or Throttling

IBM CICS TX 11.1 Remote Click Hijacking
CVE-2022-34162 6.1 - Medium - August 01, 2022

IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 229332.

Clickjacking

HTTP Header Injection in IBM CICS TX 11.1
CVE-2022-34163 6.1 - Medium - August 01, 2022

IBM CICS TX 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 229333.

XSS

IBM CICS TX 11.1 Local User Impersonation via Improper Inputs
CVE-2022-34164 5.5 - Medium - August 01, 2022

IBM CICS TX 11.1 could allow a local user to impersonate another legitimate user due to improper input validation. IBM X-Force ID: 229338.

Improper Input Validation

IBM CICS TX 11.1 Cookie Secure Flag Not Set Session Token Leak
CVE-2022-34307 4.3 - Medium - August 01, 2022

IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 229436.

Missing Encryption of Sensitive Data

CVE-2022-34161: CSRF in IBM CICS TX 11.1
CVE-2022-34161 8.8 - High - August 01, 2022

IBM CICS TX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 229331.

Session Riding

IBM CICS TX 11.1 Code Exec via Physical Access Back/Refresh Attack
CVE-2022-33955 6.8 - Medium - August 01, 2022

IBM CICS TX 11.1 could allow allow an attacker with physical access to the system to execute code due using a back and refresh attack. IBM X-Force ID: 229312.

Shell injection