The vulnerability is a stored cross‑site scripting flaw in the Web GUI of IBM Tivoli Netcool/OMNIbus. An authenticated user can inject arbitrary JavaScript that is later displayed to other users browsing the interface. Because the injected script runs with the privileges of the viewer, it can modify page content, capture session cookies, intercept user actions, or redirect to malicious sites, allowing an attacker to steal credentials or hijack a trusted session.

The flaw affects IBM Tivoli Netcool/OMNIbus version 8.1.0 and all revisions up to and including 8.1.0.41. Users running any of these releases should check whether they have applied the most recent Fix Pack and, if not, review the CPEs listed to confirm exact version compliance.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session and knowledge of an interface that accepts unfiltered user input, which limits the attack surface. Nonetheless, a successful attack could lead to credential disclosure and possible lateral movement by the attacker.