IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.
IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.
IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.
It was found that a flaw in commons-collection library allowed remote code execution wherever deserialization occurs. While JBoss doesnt expose the JMXInvokerServlet by default, other interfaces where deserialization occur might be vulnerable.
Note: classes directly referenced by this flaw: InvokerTransformer, InstantiateFactory, and InstantiateTransformer
External References:
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ https://access.redhat.com/solutions/2045023
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command.
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
IBM Financial Transaction Manager (FTM) 4.x is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.
IBM Financial Transaction Manager (FTM) could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints.
IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.
IBM Financial Transaction Manager (FTM) could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials.
IBM Financial Transaction Manager (FTM) could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials.
IBM Financial Transaction Manager (FTM) could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere.
IBM Financial Transaction Manager (FTM) 4.x is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules.
IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data.
IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity.
Last updated 25 August 2025
IBM Financial Transaction Manager (FTM) could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references.
A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentially disclosing limited memory contents
IBM Financial Transaction Manager (FTM) could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression.
IBM Financial Transaction Manager (FTM) could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization.
IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input.
IBM Financial Transaction Manager (FTM) could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command.
IBM Financial Transaction Manager (FTM) could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key.
IBM Financial Transaction Manager (FTM) could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.
IBM Financial Transaction Manager (FTM) could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery.
A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/mediawiki. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
IBM Financial Transaction Manager (FTM) could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.
Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.