CVE-2022-22387

IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 221965.

• CWE-79
• CWE-79

• https://exchange.xforce.ibmcloud.com/vulnerabilities/221965VDB Entry, Vendor Advisory
• https://www.ibm.com/support/pages/node/6824247Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/221965VDB Entry, Vendor Advisory
• https://www.ibm.com/support/pages/node/6824247Patch, Vendor Advisory

Published

Sep 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22377IBM Security Verify Privilege On-Premises 11.5 could allow a…5.3
• CVE-2022-2238A vulnerability was found in the search-api container in Red…6.5
• CVE-2022-22380 IBM Security Verify Privilege On-Premises 11.5 could allow …4.3
• CVE-2022-22384 IBM Security Verify Privilege On-Premises 11.5 could allow …4.3
• CVE-2022-22385 IBM Security Verify Privilege On-Premises 11.5 could disclo…7.5
• CVE-2022-22386 IBM Security Verify Privilege On-Premises 11.5 could allow …5.9
• CVE-2022-22389IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, a…6.5
• CVE-2022-2239The Request a Quote WordPress plugin before 2.3.9 does not s…4.8
• CVE-2022-22390IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, a…7.5
• CVE-2022-22391IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow…4.3
• CVE-2022-22392IBM Planning Analytics Local 2.0 could allow an attacker to …7.8
• CVE-2022-22393IBM WebSphere Application Server Liberty 17.0.0.3 through 22…6.5