Skip to content
Sign in
6.4 Medium

CVE-2026-115554 Tivoli Netcool/OMNIbus Web GUI is vulnerable to stored cross-site scripting

Description

IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
Tivoli Netcool/OMNIbus 8.1 8.1.0 → 8.1.0.41 No fix stated

Other CVEs of Tivoli Netcool/OMNIbus

The 20 CVEs of Tivoli Netcool/OMNIbus →
CVE-2021-29856 IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 could allow an authenticated usre to cause a denial of service through the WebGUI… 6.5 Medium CVE-2021-29821 IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting 5.4 Medium CVE-2021-29820 IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting 5.4 Medium CVE-2021-29819 IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting 5.4 Medium
Track this CVE