IBM
Page 18 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-31005 | Medium | 6.2 | 2024-02-03 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10… |
CVE-2023-31004 | High | 8.3 | 2024-02-03 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10… |
CVE-2023-30999 | High | 7.5 | 2024-02-03 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10… |
CVE-2023-38273 | High | 7.5 | 2024-02-02 | IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credent… |
CVE-2023-47142 | High | 7.5 | 2024-02-02 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization's local network to escalate their priv… |
CVE-2023-47148 | Medium | 5.3 | 2024-02-02 | IBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper validation… |
CVE-2023-47144 | Medium | 6.1 | 2024-02-02 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar… |
CVE-2023-47143 | Critical | 10.0 | 2024-02-02 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by… |
CVE-2023-38263 | Medium | 6.5 | 2024-02-02 | IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to perform unauthorized actions due to improper access controls. IBM X-Force ID… |
CVE-2023-38020 | Medium | 4.3 | 2024-02-02 | IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to manipulate output written to log files. IBM X-Force ID: 260576. |
CVE-2023-38019 | High | 8.1 | 2024-02-02 | IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted UR… |
CVE-2022-40744 | Medium | 4.8 | 2024-02-02 | IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2024-22320 | Critical | 9.8 | 2024-02-02 | IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserializatio… |
CVE-2024-22319 | High | 8.1 | 2024-02-02 | IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injec… |
CVE-2023-46159 | Low | 2.6 | 2024-02-02 | IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an authenticated user on the network to cause a denial of service from RGW. IBM X-Force ID: 268906. |
CVE-2023-50962 | Medium | 5.9 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism. IBM X-Force ID: 276004. |
CVE-2023-50941 | Medium | 6.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 does not provide logout functionality, which could allow an authenticated user to gain access to an unauthorized user using sessi… |
CVE-2023-50938 | Medium | 6.5 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site… |
CVE-2023-50935 | Medium | 6.5 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to applic… |
CVE-2023-50934 | Medium | 5.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-fact… |
CVE-2023-50328 | Low | 3.7 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings. IBM X-Force ID: 275110. |
CVE-2023-32333 | Medium | 6.5 | 2024-02-02 | IBM Maximo Asset Management 7.6.1.3 could allow a remote attacker to log into the admin panel due to improper access controls. IBM X-Force ID: 255073. |
CVE-2023-50940 | Medium | 5.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive in… |
CVE-2023-50937 | Medium | 5.9 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-F… |
CVE-2023-50936 | Medium | 6.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM… |
CVE-2023-50933 | Medium | 6.1 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the… |
CVE-2023-50327 | Medium | 5.3 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses insecure HTTP methods which could allow a remote attacker to perform unauthorized file request modification. IBM X-Force ID… |
CVE-2023-50326 | High | 7.5 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID… |
CVE-2023-50939 | Medium | 5.9 | 2024-02-02 | IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-F… |
CVE-2024-23622 | Critical | 10.0 | 2024-01-26 | A stack-based buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this vulnerabilit… |
CVE-2024-23621 | Critical | 10.0 | 2024-01-26 | A buffer overflow exists in IBM Merge Healthcare eFilm Workstation license server. A remote, unauthenticated attacker can exploit this vulnerability to achieve… |
CVE-2024-23620 | High | 8.8 | 2024-01-26 | An improper privilege management vulnerability exists in IBM Merge Healthcare eFilm Workstation. A local, authenticated attacker can exploit this vulnerability… |
CVE-2024-23619 | Critical | 9.8 | 2024-01-26 | A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this vulnerability to ach… |
CVE-2023-47141 | Medium | 5.3 | 2024-01-22 | IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service… |
CVE-2023-47747 | Medium | 5.3 | 2024-01-22 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user with CONNECT privileges to cause a den… |
CVE-2023-47158 | Medium | 5.3 | 2024-01-22 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated user with CONNECT privileges to cause a… |
CVE-2023-47152 | Medium | 5.9 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in st… |
CVE-2023-27859 | Medium | 6.5 | 2024-01-22 | IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases. A user c… |
CVE-2023-50308 | Medium | 6.5 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a… |
CVE-2023-47746 | Medium | 5.3 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user with CONNECT privileges to cause a den… |
CVE-2023-45193 | Medium | 5.9 | 2024-01-22 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is… |
CVE-2023-50963 | Medium | 6.5 | 2024-01-19 | IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. Th… |
CVE-2023-47718 | Medium | 4.3 | 2024-01-19 | IBM Maximo Asset Management 7.6.1.3 and Manage Component 8.10 through 8.11 is vulnerable to cross-site request forgery which could allow an attacker to execute… |
CVE-2023-32337 | Medium | 5.4 | 2024-01-19 | IBM Maximo Spatial Asset Management 8.10 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized req… |
CVE-2023-40683 | High | 8.8 | 2024-01-19 | IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticati… |
CVE-2023-38738 | Medium | 6.8 | 2024-01-19 | IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is usin… |
CVE-2023-35020 | Medium | 5.4 | 2024-01-19 | IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request c… |
CVE-2024-22317 | Critical | 9.1 | 2024-01-18 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.24 and 12.0.1.0 through 12.0.11.0 could allow a remote attacker to obtain sensitive information or cause a d… |
CVE-2023-50950 | Low | 3.7 | 2024-01-17 | IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709. |
CVE-2023-45171 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to cause a denial of service. IBM X-Force ID… |
CVE-2023-45169 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the pmsvcs kernel extension to cause a denial of service… |
CVE-2023-38267 | Medium | 6.2 | 2024-01-11 | IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could all… |
CVE-2023-31003 | High | 8.4 | 2024-01-11 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could all… |
CVE-2023-31001 | Medium | 5.1 | 2024-01-11 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporari… |
CVE-2023-45175 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service… |
CVE-2023-45173 | Medium | 6.2 | 2024-01-11 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the NFS kernel extension to cause a denial of service. IB… |
CVE-2023-47140 | Medium | 4.0 | 2024-01-08 | IBM CICS Transaction Gateway 9.3 could allow a user to transfer or view files due to improper access controls. |
CVE-2023-50948 | Medium | 6.5 | 2024-01-08 | IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenti… |
CVE-2023-47145 | High | 8.4 | 2024-01-07 | IBM Db2 for Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a local user to escalate their privileges to the SYSTEM user using the MSI r… |
CVE-2023-49880 | High | 7.5 | 2023-12-25 | In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN me… |
CVE-2023-43064 | High | 7.0 | 2023-12-25 | Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor… |
CVE-2021-38927 | High | 7.2 | 2023-12-25 | IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2023-45165 | Medium | 6.2 | 2023-12-22 | IBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM X-Force ID: 26… |
CVE-2023-42017 | High | 8.0 | 2023-12-22 | IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a s… |
CVE-2023-35895 | Medium | 6.3 | 2023-12-20 | IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API… |
CVE-2023-47707 | Medium | 5.4 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2023-47705 | Medium | 4.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID… |
CVE-2023-47703 | Medium | 5.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2023-47702 | Medium | 4.3 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted… |
CVE-2023-47706 | Medium | 6.6 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341. |
CVE-2023-47704 | Medium | 4.0 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220. |
CVE-2023-47161 | Medium | 5.3 | 2023-12-20 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 may mishandle input validation of an uploaded archive file leadin… |
CVE-2023-42013 | Medium | 5.3 | 2023-12-20 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 could allow a remote attacker to obtain sensitive information whe… |
CVE-2023-42012 | Medium | 6.2 | 2023-12-20 | An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a deni… |
CVE-2023-45172 | Medium | 6.2 | 2023-12-19 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in AIX windows to cause a denial of service. IBM X-Force ID… |
CVE-2023-47146 | Medium | 4.9 | 2023-12-19 | IBM Qradar SIEM 7.5 could allow a privileged user to obtain sensitive domain information due to data being misidentified. IBM X-Force ID: 270372. |
CVE-2023-42015 | Medium | 4.3 | 2023-12-19 | IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 is vulnerable to HTML injection. This vulnerability may allow a u… |
CVE-2023-40691 | Medium | 4.9 | 2023-12-18 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may re… |
CVE-2023-47741 | Medium | 5.3 | 2023-12-18 | IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common b… |
CVE-2023-46177 | Medium | 6.5 | 2023-12-18 | IBM MQ Appliance 9.3 LTS and 9.3 CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL reques… |
CVE-2023-45185 | High | 7.4 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Due to improper authority checks… |
CVE-2023-45182 | High | 7.4 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow ga… |
CVE-2023-45184 | Medium | 6.2 | 2023-12-14 | IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority chec… |
CVE-2023-43042 | High | 7.5 | 2023-12-14 | IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID… |
CVE-2022-43843 | Medium | 5.9 | 2023-12-14 | IBM Spectrum Scale 5.1.5.0 through 5.1.5.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |
CVE-2023-45174 | High | 8.4 | 2023-12-13 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a privileged local user to exploit a vulnerability in the qdaemon command to escalate privileges or cause a denial o… |
CVE-2023-45170 | High | 8.4 | 2023-12-13 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piobe command to escalate privileges or cause a denial… |
CVE-2023-45166 | High | 8.4 | 2023-12-13 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the piodmgrsu command to obtain elevated privileges. IBM… |
CVE-2023-49878 | Medium | 4.3 | 2023-12-13 | IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive information when a detailed t… |
CVE-2023-49877 | Medium | 4.3 | 2023-12-13 | IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive information, caused… |
CVE-2023-47722 | Medium | 6.2 | 2023-12-09 | IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user. IBM X-Force ID: 271912. |
CVE-2023-28527 | Medium | 6.2 | 2023-12-09 | IBM Informix Dynamic Server 12.10 and 14.10 cdr is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local user to… |
CVE-2023-28526 | Medium | 6.2 | 2023-12-09 | IBM Informix Dynamic Server 12.10 and 14.10 archecker is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow a local us… |
CVE-2023-28523 | High | 8.4 | 2023-12-09 | IBM Informix Dynamic Server 12.10 and 14.10 onsmsync is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allow an attacker… |
CVE-2023-40687 | Medium | 5.3 | 2023-12-04 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted RUNSTATS com… |
CVE-2023-38727 | Medium | 5.3 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted SQL statemen… |
CVE-2023-29258 | Medium | 5.3 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, and 11.5 is vulnerable to a denial of service through a specially crafted federated que… |
CVE-2023-47701 | Medium | 6.5 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM… |
CVE-2023-46167 | Medium | 5.9 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of service when a specially crafted cursor is… |
CVE-2023-38003 | High | 7.2 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow a user with DATAACCESS privileges to execute routines that t… |