IBM Cyber Fraud versions 1.0.0 through 1.1.0 contain a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript into the web user interface. This can alter the intended functionality and potentially lead to credential disclosure within a trusted session.