IBM
Page 19 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-40692 | Medium | 5.9 | 2023-12-04 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to denial of service under extreme stress conditions. IBM X-F… |
CVE-2023-45178 | Medium | 6.5 | 2023-12-03 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 CLI is vulnerable to a denial of service when a specially crafted request is used. IBM… |
CVE-2023-46174 | Medium | 5.4 | 2023-12-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-43021 | Medium | 5.3 | 2023-12-01 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in th… |
CVE-2023-42022 | Medium | 5.4 | 2023-12-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-42019 | Medium | 5.9 | 2023-12-01 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161… |
CVE-2023-42009 | Medium | 5.4 | 2023-12-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-40699 | High | 7.5 | 2023-12-01 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161… |
CVE-2023-43015 | Medium | 5.4 | 2023-12-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-38268 | Medium | 4.3 | 2023-12-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2023-26024 | Medium | 6.5 | 2023-12-01 | IBM Planning Analytics on Cloud Pak for Data 4.0 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communi… |
CVE-2023-42006 | High | 8.4 | 2023-12-01 | IBM Administration Runtime Expert for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to obtain sensitive information caused by improper authority checks. I… |
CVE-2023-45168 | High | 8.4 | 2023-12-01 | IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X… |
CVE-2023-42004 | High | 8.0 | 2023-11-28 | IBM Security Guardium 11.3, 11.4, and 11.5 is potentially vulnerable to CSV injection. A remote attacker could execute malicious commands due to improper vali… |
CVE-2023-26279 | Low | 3.3 | 2023-11-24 | IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a local user to perform unauthorized actions due to improper encoding. IBM X-Force ID: 248160. |
CVE-2021-39008 | Low | 2.7 | 2023-11-23 | IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a privileged user to obtain sensitive information due to missing best practices. IBM X-Force ID: 2… |
CVE-2023-25682 | Medium | 6.2 | 2023-11-22 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 stores potentially sensitive information in log files that cou… |
CVE-2022-36777 | Medium | 4.3 | 2023-11-22 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obta… |
CVE-2022-35638 | Medium | 4.3 | 2023-11-22 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 is vulnerable to cross-site request forgery which could allow… |
CVE-2023-40363 | High | 8.1 | 2023-11-18 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to change installation files due to incorrect file permission settings. IBM X-Force I… |
CVE-2023-38361 | Medium | 5.9 | 2023-11-18 | IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2023-38364 | Medium | 6.1 | 2023-11-13 | IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2023-38363 | Medium | 4.3 | 2023-11-13 | IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by send… |
CVE-2023-43057 | Medium | 4.6 | 2023-11-11 | IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… |
CVE-2023-45167 | Medium | 6.2 | 2023-11-10 | IBM AIX's 7.3 Python implementation could allow a non-privileged local user to exploit a vulnerability to cause a denial of service. IBM X-Force ID: 267965. |
CVE-2023-45189 | Medium | 6.5 | 2023-11-03 | A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result… |
CVE-2023-35896 | Medium | 5.4 | 2023-11-03 | IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from t… |
CVE-2023-46176 | Medium | 6.7 | 2023-11-03 | IBM MQ Appliance 9.3 CD could allow a local attacker to gain elevated privileges on the system, caused by improper validation of security keys. IBM X-Force ID… |
CVE-2023-43018 | Medium | 5.9 | 2023-11-03 | IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new… |
CVE-2023-42029 | Medium | 4.8 | 2023-11-03 | IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows… |
CVE-2023-42027 | Medium | 4.3 | 2023-11-03 | IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an… |
CVE-2023-40685 | High | 7.4 | 2023-10-29 | Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line… |
CVE-2023-43041 | Medium | 6.5 | 2023-10-29 | IBM QRadar SIEM 7.5 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific domain security profile assigned to see data f… |
CVE-2023-40686 | Medium | 4.9 | 2023-10-29 | Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line… |
CVE-2023-46158 | Medium | 4.9 | 2023-10-25 | IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling… |
CVE-2023-42031 | Medium | 4.9 | 2023-10-25 | IBM TXSeries for Multiplatforms, 8.1, 8.2, and 9.1, CICS TX Standard CICS TX Advanced 10.1 and 11.1 could allow a privileged user to cause a denial of service… |
CVE-2023-33840 | Medium | 4.8 | 2023-10-23 | IBM Security Verify Governance 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2023-33839 | High | 7.2 | 2023-10-23 | IBM Security Verify Governance 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted requ… |
CVE-2023-33837 | Medium | 4.1 | 2023-10-23 | IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020. |
CVE-2022-22466 | Medium | 6.8 | 2023-10-23 | IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2023-43045 | Medium | 5.9 | 2023-10-23 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM… |
CVE-2023-38722 | Medium | 6.4 | 2023-10-23 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrar… |
CVE-2023-38735 | Medium | 5.7 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attack… |
CVE-2023-38276 | Medium | 5.9 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in environment variables which could aid in further attacks against the system… |
CVE-2023-38275 | Medium | 5.9 | 2023-10-22 | IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 exposes sensitive information in container images which could lead to further attacks against the system. IB… |
CVE-2022-43892 | Low | 3.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 does not validate, or incorrectly validates, a certificate which could disclose sensitive information which cou… |
CVE-2022-43891 | Low | 2.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2022-43893 | Low | 2.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload. IBM X-Force ID: 240634. |
CVE-2022-43889 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks agai… |
CVE-2022-22386 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP St… |
CVE-2022-22385 | Medium | 5.9 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text. IBM X-Force… |
CVE-2022-22380 | Medium | 5.0 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates. IBM X-Force ID… |
CVE-2022-22375 | High | 7.2 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2021-38859 | Medium | 4.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain version number information using a specially crafted HTTP request that could be us… |
CVE-2021-29913 | Medium | 6.5 | 2023-10-17 | IBM Security Verify Privilege On-Premise 11.5 could allow an authenticated user to obtain sensitive information or perform unauthorized actions due to imprope… |
CVE-2021-20581 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 19… |
CVE-2022-22384 | Medium | 4.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to modify messages returned from the server due to hazardous input validation. IBM X-Fo… |
CVE-2022-22377 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Str… |
CVE-2023-40373 | Medium | 5.3 | 2023-10-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table exp… |
CVE-2023-40372 | Medium | 5.3 | 2023-10-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted SQL statement using External… |
CVE-2023-38719 | Medium | 5.1 | 2023-10-17 | IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during database deactivation on DPF. IBM X-Force ID: 261607. |
CVE-2023-40374 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted query statement. IBM X-Forc… |
CVE-2023-30991 | High | 7.5 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to denial of service with a specially crafted query. IBM X-Force… |
CVE-2023-38740 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX, and Windows (includes Db2 Connect Server) 11.5 is vulnerable to a denial of service with a specially crafted SQL statement. IBM X-For… |
CVE-2023-38728 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted XML query st… |
CVE-2023-38720 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE stateme… |
CVE-2023-30987 | Medium | 5.3 | 2023-10-16 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-38280 | High | 8.4 | 2023-10-16 | IBM HMC (Hardware Management Console) 10.1.1010.0 and 10.2.1030.0 could allow a local user to escalate their privileges to root access on a restricted shell… |
CVE-2023-40377 | Medium | 4.9 | 2023-10-16 | Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability. A malicious actor with command li… |
CVE-2023-33836 | Medium | 5.3 | 2023-10-16 | IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2023-35018 | Low | 3.3 | 2023-10-16 | IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID: 259382. |
CVE-2023-35013 | Low | 2.3 | 2023-10-16 | IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code. IBM X-Force ID: 2… |
CVE-2023-40378 | Medium | 4.9 | 2023-10-15 | IBM Directory Server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system ca… |
CVE-2023-40367 | Medium | 5.4 | 2023-10-14 | IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… |
CVE-2023-30994 | Medium | 5.4 | 2023-10-14 | IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID… |
CVE-2023-45176 | Medium | 6.2 | 2023-10-14 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of s… |
CVE-2023-35024 | Medium | 4.6 | 2023-10-14 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vul… |
CVE-2022-43868 | Medium | 5.3 | 2023-10-14 | IBM Security Verify Access OIDC Provider could disclose directory information that could aid attackers in further attacks against the system. IBM X-Force ID… |
CVE-2022-43740 | High | 7.5 | 2023-10-14 | IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238… |
CVE-2022-33165 | Medium | 6.8 | 2023-10-14 | IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request… |
CVE-2022-33161 | Medium | 5.3 | 2023-10-14 | IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2022-32755 | Medium | 5.5 | 2023-10-14 | IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit th… |
CVE-2023-40682 | Medium | 4.4 | 2023-10-13 | IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive informa… |
CVE-2022-33160 | Low | 3.7 | 2023-10-06 | IBM Security Directory Suite 8.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IB… |
CVE-2022-34355 | Medium | 4.0 | 2023-10-06 | IBM Jazz Foundation (IBM Engineering Lifecycle Management 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) could disclose sensitive version information to a user that co… |
CVE-2023-43058 | Medium | 5.3 | 2023-10-06 | IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects. IBM X-Force ID: 247527. |
CVE-2023-35897 | High | 8.4 | 2023-10-06 | IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the… |
CVE-2023-40684 | Medium | 4.6 | 2023-10-04 | IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed… |
CVE-2023-40376 | Medium | 5.3 | 2023-10-04 | IBM UrbanCode Deploy (UCD) 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make… |
CVE-2022-43906 | Low | 3.1 | 2023-10-04 | IBM Security Guardium 11.5 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 24089… |
CVE-2023-37404 | Medium | 6.4 | 2023-10-04 | IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS pois… |
CVE-2023-35905 | Medium | 4.6 | 2023-10-04 | IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2022-22447 | Medium | 4.0 | 2023-10-04 | IBM Disconnected Log Collector 1.0 through 1.8.2 is vulnerable to potential security misconfigurations that could disclose unintended information. IBM X-Force… |
CVE-2023-43044 | Medium | 5.3 | 2023-09-28 | IBM License Metric Tool 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request contain… |
CVE-2023-40375 | High | 7.4 | 2023-09-28 | Integrated application server for IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious actor with command line access… |
CVE-2023-38718 | Low | 3.7 | 2023-09-20 | IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from access to RPA scripts, workflows and related data. IBM X-Forc… |
CVE-2023-37410 | High | 8.4 | 2023-09-20 | IBM Personal Communications 14.05, 14.06, and 15.0.0 could allow a local user to escalate their privileges to the SYSTEM user due to overly permissive access c… |
CVE-2023-40368 | Medium | 4.4 | 2023-09-20 | IBM Storage Protect 8.1.0.0 through 8.1.19.0 could allow a privileged user to obtain sensitive information from the administrative command line client. IBM X-… |
CVE-2022-22409 | Medium | 5.3 | 2023-09-08 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration. IBM X-Fo… |
CVE-2022-22402 | Medium | 5.4 | 2023-09-08 | IBM Aspera Faspex 5.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t… |