IBM Corporation
288 CVEs across 85 IBM Corporation products. Browse IBM Corporation vulnerabilities, severities, and proof-of-concept exploits.
IBM Corporation products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-4301 | High | 8.4 | 2020-02-28 | BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML. |
CVE-2019-4392 | Critical | 9.8 | 2020-02-14 | HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system. |
CVE-2018-9068 | High | 7.5 | 2018-07-26 | The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is… |
CVE-2017-1320 | Medium | 5.4 | 2017-05-22 | IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2017-1289 | High | 8.2 | 2017-05-22 | IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnera… |
CVE-2017-1282 | Medium | 5.4 | 2017-05-22 | IBM Content Navigator & CMIS 2.0 and 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2017-1159 | Medium | 5.4 | 2017-05-22 | IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vi… |
CVE-2017-1092 | Critical | 9.8 | 2017-05-22 | IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID… |
CVE-2016-6112 | High | 8.8 | 2017-05-22 | IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative… |
CVE-2016-9750 | Medium | 6.5 | 2017-05-15 | IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 120207. |
CVE-2016-9735 | Medium | 4.3 | 2017-05-15 | IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID: 119781, |
CVE-2016-5979 | Low | 2.7 | 2017-05-15 | IBM Distributed Marketing 8.6, 9.0, and 10.0 could allow a privileged authenticated user to create an instance that gets created with security profile not vali… |
CVE-2017-1137 | High | 8.1 | 2017-05-10 | IBM WebSphere Application Server 8.0 and 8.5.5 could provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive i… |
CVE-2017-1103 | High | 8.1 | 2017-05-10 | IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker… |
CVE-2016-6037 | Medium | 4.8 | 2017-05-10 | IBM Rational Team Concert (RTC) is vulnerable to HTML injection. A remote attacker with project administrator privileges could send a project that contains mal… |
CVE-2016-6035 | Medium | 5.4 | 2017-05-10 | IBM Rational Quality Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2016-5889 | High | 8.8 | 2017-05-10 | IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tr… |
CVE-2016-5888 | Medium | 5.4 | 2017-05-10 | IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2016-3032 | Medium | 5.4 | 2017-05-10 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2017-1156 | High | 8.8 | 2017-05-05 | IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a sp… |
CVE-2016-9692 | High | 8.6 | 2017-05-05 | IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input… |
CVE-2016-9691 | High | 8.6 | 2017-05-05 | IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing… |
CVE-2016-0255 | Medium | 6.1 | 2017-05-05 | IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could… |
CVE-2016-9976 | High | 8.4 | 2017-05-03 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL re… |
CVE-2016-2930 | High | 7.5 | 2017-05-03 | IBM BigFix Remote Control 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication. IBM X-Force ID: 5512. |
CVE-2016-0382 | Medium | 4.0 | 2017-05-03 | The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captured and exposed by n… |
CVE-2017-1194 | High | 8.8 | 2017-04-28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau… |
CVE-2017-1141 | Medium | 4.3 | 2017-04-28 | IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages. IBM X-Force ID: 121… |
CVE-2017-1170 | Medium | 5.3 | 2017-04-26 | IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230. |
CVE-2016-8962 | Medium | 5.9 | 2017-04-26 | IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts… |
CVE-2016-8924 | Medium | 5.6 | 2017-04-26 | IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session… |
CVE-2017-1161 | High | 7.3 | 2017-04-17 | IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Port… |
CVE-2017-1160 | Medium | 5.4 | 2017-04-17 | IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.0.x is vulnerable to cross-site scripting. This vulnerability allows users to embed a… |
CVE-2016-3038 | Medium | 5.4 | 2017-04-17 | IBM Cognos TM1 10.1 and 10.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2016-3037 | Medium | 5.7 | 2017-04-17 | IBM Cognos TM1 10.1 and 10.2 provides a service to return the victim's password with a valid session key. An authenticated attacker with user interaction could… |
CVE-2016-3036 | High | 7.5 | 2017-04-17 | IBM Cognos TM1 10.1 and 10.2 is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing packets. A remote attacker could exploi… |
CVE-2016-0228 | Medium | 5.4 | 2017-04-17 | IBM Marketing Platform 10.0 could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in various scripts. An attacker… |
CVE-2017-1205 | High | 8.8 | 2017-04-14 | IBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to escalate their privileges and obtain root access. IBM X-Force ID… |
CVE-2017-1152 | Medium | 4.3 | 2017-04-14 | IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in furthe… |
CVE-2016-8927 | Medium | 5.4 | 2017-04-14 | IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav… |
CVE-2016-8926 | Medium | 4.3 | 2017-04-14 | IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to read system files or data that is restricted to authorized u… |
CVE-2016-8925 | Medium | 6.5 | 2017-04-14 | IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to include arbitrary files which could allow the attacker to re… |
CVE-2017-1180 | Medium | 5.3 | 2017-04-05 | The IBM TRIRIGA Document Manager contains a vulnerability that could allow an authenticated user to execute actions they did not have access to. IBM Reference… |
CVE-2016-6100 | High | 8.8 | 2017-04-05 | IBM Disposal and Governance Management for IT and IBM Global Retention Policy and Schedule Management, components of IBM Atlas Policy Suite 6.0.3 is vulnerable… |
CVE-2016-3031 | Medium | 5.4 | 2017-04-05 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2016-3015 | Medium | 5.4 | 2017-04-05 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2017-1171 | Medium | 4.3 | 2017-03-31 | The IBM TRIRIGA Application Platform 3.3, 3,4, and 3,5 contain a vulnerability that could allow an authenticated user to execute Application actions they do no… |
CVE-2017-1154 | Medium | 6.5 | 2017-03-31 | IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to files in the local environment which should not be viewed… |
CVE-2016-9990 | Medium | 6.1 | 2017-03-31 | IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2016-9707 | High | 8.1 | 2017-03-31 | IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker co… |
CVE-2016-8935 | Medium | 5.4 | 2017-03-31 | IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrar… |
CVE-2016-8917 | High | 8.8 | 2017-03-31 | IBM Sterling Order Management 9.2 - 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2016-6111 | Critical | 9.1 | 2017-03-31 | IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing X… |
CVE-2016-6036 | Medium | 5.4 | 2017-03-31 | IBM Rational Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2016-6031 | Medium | 5.4 | 2017-03-31 | IBM Rational Quality Manager 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2016-6022 | Medium | 5.4 | 2017-03-31 | IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2017-1153 | High | 8.8 | 2017-03-27 | IBM TRIRIGA Report Manager 3.2 through 3.5 contains a vulnerability that could allow an authenticated user to execute actions that they do not have access to… |
CVE-2017-1143 | Medium | 5.3 | 2017-03-27 | IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Stri… |
CVE-2017-1142 | Medium | 6.5 | 2017-03-27 | IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for t… |
CVE-2017-1120 | Medium | 6.1 | 2017-03-27 | IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-9737 | Medium | 5.4 | 2017-03-27 | IBM TRIRIGA 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2016-8960 | High | 8.8 | 2017-03-27 | IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting… |
CVE-2016-6102 | Low | 3.7 | 2017-03-27 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties ha… |
CVE-2016-6056 | Medium | 5.4 | 2017-03-27 | IBM Call Center for Commerce 9.3 and 9.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2017-1155 | Medium | 4.3 | 2017-03-20 | IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to another user's reports using a specially crafted HTTP req… |
CVE-2017-1151 | High | 8.1 | 2017-03-20 | IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user… |
CVE-2017-1146 | Medium | 5.4 | 2017-03-20 | IBM Content Navigator 2.0.3 and 3.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2017-1145 | High | 8.6 | 2017-03-20 | IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service throu… |
CVE-2017-1134 | High | 7.8 | 2017-03-20 | IBM Reliable Scalable Cluster Technology could allow a local user to escalate their privileges to gain root access. IBM Reference #: 1998459. |
CVE-2016-9697 | Low | 3.1 | 2017-03-20 | An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. A JSON Hijacking Attack may expos… |
CVE-2016-9696 | Medium | 5.4 | 2017-03-20 | IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in… |
CVE-2016-9694 | Medium | 5.4 | 2017-03-20 | IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2016-8973 | Medium | 4.3 | 2017-03-20 | IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious files to the server. I… |
CVE-2016-2981 | Medium | 6.8 | 2017-03-20 | An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference #: 1999965. |
CVE-2017-1150 | Low | 3.1 | 2017-03-08 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated attacker with specialized access to tables… |
CVE-2016-9985 | Medium | 5.5 | 2017-03-08 | IBM Cognos Server 10.1.1 and 10.2 stores highly sensitive information in log files that could be read by a local user. IBM Reference #: 1999671. |
CVE-2016-9006 | Medium | 5.4 | 2017-03-08 | IBM UrbanCode Deploy 6.1 and 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5933 | Medium | 4.6 | 2017-03-08 | IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Refere… |
CVE-2016-5894 | Medium | 5.1 | 2017-03-08 | IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could v… |
CVE-2017-1133 | Medium | 5.4 | 2017-03-07 | IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend… |
CVE-2017-1124 | Low | 2.9 | 2017-03-07 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference #: 199805… |
CVE-2016-9740 | High | 7.5 | 2017-03-07 | IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of resources requested b… |
CVE-2016-9730 | Medium | 4.3 | 2017-03-07 | IBM QRadar Incident Forensics 7.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions trans… |
CVE-2016-9729 | Medium | 6.5 | 2017-03-07 | IBM QRadar 7.2 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM Refere… |
CVE-2016-9728 | High | 7.5 | 2017-03-07 | IBM Qradar 7.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, informati… |
CVE-2016-9727 | High | 8.5 | 2017-03-07 | IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker cou… |
CVE-2016-9725 | Medium | 5.3 | 2017-03-07 | IBM QRadar Incident Forensics 7.2 allows for Cross-Origin Resource Sharing (CORS), which is a mechanism that allows web sites to request resources from externa… |
CVE-2016-9724 | High | 8.1 | 2017-03-07 | IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could e… |
CVE-2016-9723 | Medium | 6.1 | 2017-03-07 | IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend… |
CVE-2016-9720 | Medium | 5.3 | 2017-03-07 | IBM QRadar 7.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM Reference #: 1999… |
CVE-2016-9693 | Medium | 6.1 | 2017-03-07 | IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unau… |
CVE-2016-8971 | Medium | 6.5 | 2017-03-07 | IBM WebSphere MQ 8.0 could allow an authenticated user with queue manager permissions to cause a segmentation fault which would result in the box having to be… |
CVE-2016-8940 | High | 8.8 | 2017-03-07 | IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacke… |
CVE-2016-9994 | High | 7.1 | 2017-03-01 | IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could all… |
CVE-2016-9993 | High | 7.1 | 2017-03-01 | IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could all… |
CVE-2016-9992 | High | 7.1 | 2017-03-01 | IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could all… |
CVE-2016-5932 | Medium | 5.4 | 2017-03-01 | IBM Connections 4.0, 4.5, 5.0, and 5.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2016-2880 | High | 7.8 | 2017-03-01 | IBM QRadar 7.2 stores the encryption key used to encrypt the service account password which can be obtained by a local user. IBM Reference #: 1997340. |
CVE-2016-2879 | High | 7.8 | 2017-03-01 | IBM QRadar 7.2 uses outdated hashing algorithms to hash certain passwords, which could allow a local user to obtain and decrypt user credentials. IBM Reference… |
CVE-2016-9975 | High | 8.8 | 2017-02-24 | IBM Jazz for Service Management 1.1.2.1 and 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |