IBM Content Navigator

IBM Content Navigator 3.0.x3.2.0 Directory Listing Disclosure
CVE-2025-27906 5.3 - Medium - October 14, 2025

IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application upon using an application URL. Application files and folders are visible in the browser to a user; however, the contents of the files cannot be read obtained or modified.

Exposure of Information Through Directory Listing

IBM Content Navigator 3.0.11–3.1.0: HTML Injection Vulnerability
CVE-2024-51475 6.1 - Medium - May 16, 2025

IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

XSS

IBM Content Navigator 3.0.11/3.0.15/3.1.0 Authenticated XSS in Web UI
CVE-2024-56341 5.4 - Medium - April 02, 2025

IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

XSS

IBM Content Navigator 3.0.13 SSRF Vulnerability
CVE-2023-35896 5.4 - Medium - November 03, 2023

IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 259247.

SSRF

IBM Content Navigator 3.0.11-3.0.14 XSS via JS embed
CVE-2023-40684 5.4 - Medium - October 04, 2023

IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 264019.

XSS

IBM Content Navigator 3.0.* Auth Bypass: AuthUser Can Load Ext Plug & Exec Code
CVE-2022-43581 8.8 - High - December 07, 2022

IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to missing authorization and could allow an authenticated user to load external plugins and execute code. IBM X-Force ID: 238805.

AuthZ

IBM Content Navigator 3.0.CD could allow a malicious user to cause a denial of service due to improper input validation
CVE-2021-29714 6.5 - Medium - August 09, 2021

IBM Content Navigator 3.0.CD could allow a malicious user to cause a denial of service due to improper input validation. IBM X-Force ID: 200968.

Improper Input Validation

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting
CVE-2021-20550 - April 27, 2021

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199168.

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting
CVE-2021-20549 - April 27, 2021

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199167.

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting
CVE-2021-20448 - April 27, 2021

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196624.

IBM Content Navigator 3.0CD is vulnerable to cross-site scripting
CVE-2020-4760 5.4 - Medium - November 10, 2020

IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188737.

XSS

IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting
CVE-2020-4704 5.4 - Medium - November 10, 2020

IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187189.

XSS

IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user
CVE-2020-4309 5.3 - Medium - March 24, 2020

IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user which could be used to aid in further attacks against the system. IBM X-Force ID: 177080.

Information Disclosure

IBM Content Navigator 3.0CD does not invalidate session after logout which could
CVE-2020-4253 8.8 - High - March 24, 2020

IBM Content Navigator 3.0CD does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 175559.

Insufficient Session Expiration

IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version
CVE-2019-4679 4.3 - Medium - January 28, 2020

IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could be used in further attacks against the system. IBM X-Force ID: 171515.

IBM Content Navigator 3.0CD is vulnerable to cross-site scripting
CVE-2019-4571 5.4 - Medium - September 25, 2019

IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 166721.

XSS

IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server
CVE-2019-4263 4.3 - Medium - July 11, 2019

IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 160015.

Inclusion of Functionality from Untrusted Control Sphere

IBM Content Navigator 2.0.3 and 3.0CD could allow a remote attacker to conduct phishing attacks, using an open redirect attack
CVE-2019-4092 6.1 - Medium - April 25, 2019

IBM Content Navigator 2.0.3 and 3.0CD could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 157654.

Open Redirect

IBM Content Navigator 2.0.3 and 3.0CD is vulnerable to cross-site scripting
CVE-2019-4033 5.4 - Medium - April 25, 2019

IBM Content Navigator 2.0.3 and 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155999.

XSS

IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site
CVE-2019-4035 5.4 - Medium - March 22, 2019

IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X-Force ID: 156001.

Open Redirect

IBM Content Navigator 3.0CD is could allow an attacker to execute arbitrary code on a user's workstation
CVE-2019-4034 8.8 - High - March 14, 2019

IBM Content Navigator 3.0CD is could allow an attacker to execute arbitrary code on a user's workstation. When editing an executable file in ICN with Edit service, it will be executed on the user's workstation. IBM X-Force ID: 156000.

IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting
CVE-2018-1496 - May 31, 2018

IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141219.

IBM Content Navigator 2.0 and 3.0 is vulnerable to Comma Separated Value (CSV) Injection
CVE-2018-1366 7.8 - High - February 07, 2018

IBM Content Navigator 2.0 and 3.0 is vulnerable to Comma Separated Value (CSV) Injection. An attacker could exploit this vulnerability to exploit other vulnerabilities in spreadsheet software. IBM X-Force ID: 137452.

IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data
CVE-2018-1364 8.2 - High - January 29, 2018

IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 137449.

XXE

IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting
CVE-2017-1522 - October 05, 2017

IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129832.

IBM Content Navigator 2.0.3 and 3.0.0 is vulnerable to cross-site scripting
CVE-2017-1331 - August 04, 2017

IBM Content Navigator 2.0.3 and 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126233.