IBM
Page 20 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22401 | Medium | 5.9 | 2023-09-08 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information. IBM X-Force ID: 222567. |
CVE-2023-30995 | High | 7.5 | 2023-09-08 | IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP requ… |
CVE-2023-24965 | Medium | 5.8 | 2023-09-08 | IBM Aspera Faspex 5.0.5 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. IBM X-Force ID: 246713. |
CVE-2022-22405 | Medium | 5.9 | 2023-09-08 | IBM Aspera Faspex 5.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security… |
CVE-2023-32332 | Medium | 5.4 | 2023-09-08 | IBM Maximo Application Suite 8.9, 8.10 and IBM Maximo Asset Management 7.6.1.2, 7.6.1.3 are vulnerable to HTML injection. A remote attacker could inject malici… |
CVE-2022-33164 | High | 8.7 | 2023-09-08 | IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request… |
CVE-2023-38736 | High | 7.5 | 2023-09-08 | IBM QRadar WinCollect Agent 10.0 through 10.1.6, when installed to run as ADMIN or SYSTEM, is vulnerable to a local escalation of privilege attack that a norma… |
CVE-2023-35906 | Medium | 5.3 | 2023-09-05 | IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649. |
CVE-2023-29261 | Medium | 5.1 | 2023-09-05 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow a local user with specific information about the system to obtain privileged information due to inadequat… |
CVE-2023-22870 | Medium | 5.9 | 2023-09-05 | IBM Aspera Faspex 5.0.5 transmits sensitive information in cleartext which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID… |
CVE-2023-35892 | High | 7.1 | 2023-09-05 | IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote at… |
CVE-2023-32338 | Medium | 5.1 | 2023-09-05 | IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a lo… |
CVE-2022-43903 | Medium | 4.3 | 2023-09-05 | IBM Security Guardium 10.6, 11.3, and 11.4 could allow an authenticated user to cause a denial of service due to due to improper input validation. IBM X-Force… |
CVE-2023-33835 | Medium | 4.3 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against… |
CVE-2023-33834 | Medium | 4.3 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 could allow a remote attacker to obtain sensitive information that could aid in further attacks against… |
CVE-2023-33833 | Low | 2.9 | 2023-08-31 | IBM Security Verify Information Queue 10.0.4 and 10.0.5 stores sensitive information in plain clear text which can be read by a local user. IBM X-Force ID: 2… |
CVE-2023-1995 | Medium | 5.3 | 2023-08-29 | Insufficient Logging vulnerability in Hitachi HiRDB Server, HiRDB Server With Addtional Function, HiRDB Structured Data Access Facility.This issue affects HiRD… |
CVE-2023-26272 | Medium | 5.3 | 2023-08-28 | IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to obtain sensitive information when a deta… |
CVE-2023-26271 | Medium | 5.3 | 2023-08-28 | IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) uses an inadequate account lockout setting that could allow a remote atta… |
CVE-2023-26270 | Medium | 6.5 | 2023-08-28 | IBM Security Guardium Data Encryption (IBM Guardium Cloud Key Manager (GCKM) 1.10.3)) could allow a remote attacker to execute arbitrary code on the system, ca… |
CVE-2023-24959 | Medium | 5.3 | 2023-08-28 | IBM InfoSphere Information Systems 11.7 could expose information about the host system and environment configuration. IBM X-Force ID: 246332. |
CVE-2023-23473 | Medium | 5.3 | 2023-08-28 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2023-22877 | High | 7.0 | 2023-08-28 | IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by… |
CVE-2022-43904 | High | 7.5 | 2023-08-28 | IBM Security Guardium 11.3 and 11.4 could disclose sensitive information to an attacker due to improper restriction of excessive authentication attempts. IBM… |
CVE-2023-38730 | Medium | 5.9 | 2023-08-27 | IBM Storage Copy Data Management 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2023-33852 | High | 7.6 | 2023-08-27 | IBM Security Guardium 11.4 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to vie… |
CVE-2023-30437 | Medium | 5.3 | 2023-08-27 | IBM Security Guardium 11.3, 11.4, and 11.5 could allow an unauthorized user to enumerate usernames by sending a specially crafted HTTP request. IBM X-Force ID… |
CVE-2023-30436 | Medium | 5.5 | 2023-08-27 | IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2023-30435 | High | 8.9 | 2023-08-27 | IBM Security Guardium 11.3, 11.4, and 11.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2022-43909 | Medium | 4.6 | 2023-08-27 | IBM Security Guardium 11.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2022-43907 | High | 7.2 | 2023-08-27 | IBM Security Guardium 11.4 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM… |
CVE-2023-40371 | Medium | 6.2 | 2023-08-24 | IBM AIX 7.2, 7.3, VIOS 3.1's OpenSSH implementation could allow a non-privileged local user to access files outside of those allowed due to improper access con… |
CVE-2023-40370 | Low | 3.7 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7.1 runtime is vulnerable to information disclosure of script content if the remote REST request computer p… |
CVE-2023-38734 | Medium | 6.6 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an… |
CVE-2023-38733 | Medium | 4.3 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from i… |
CVE-2023-33850 | High | 7.5 | 2023-08-22 | IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By… |
CVE-2023-38732 | Medium | 4.3 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs. IBM X-Force… |
CVE-2023-35011 | Medium | 5.4 | 2023-08-16 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthori… |
CVE-2023-35009 | Medium | 5.3 | 2023-08-16 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconn… |
CVE-2023-35893 | Critical | 9.9 | 2023-08-16 | IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2023-38737 | Medium | 5.9 | 2023-08-16 | IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remo… |
CVE-2023-38741 | High | 7.5 | 2023-08-14 | IBM TXSeries for Multiplatforms 8.1, 8.2, and 9.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read opera… |
CVE-2023-38721 | High | 8.4 | 2023-08-14 | The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor could gain access to… |
CVE-2023-23476 | Low | 3.1 | 2023-08-02 | IBM Robotic Process Automation 21.0.0 through 21.0.7.latest is vulnerable to unauthorized access to data due to insufficient authorization validation on some A… |
CVE-2022-40609 | High | 8.1 | 2023-08-02 | IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserializatio… |
CVE-2023-24971 | High | 7.5 | 2023-07-31 | IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 could allow a user to cause a denial of service due to the deseri… |
CVE-2023-22595 | Medium | 5.4 | 2023-07-31 | IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows… |
CVE-2020-4868 | Medium | 4.3 | 2023-07-31 | IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2023-35019 | High | 7.2 | 2023-07-31 | IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a spec… |
CVE-2023-35016 | Medium | 6.5 | 2023-07-31 | IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially c… |
CVE-2022-43831 | High | 7.4 | 2023-07-31 | IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.6.1 could allow a local user to obtain escalated privileges on a host without proper secu… |
CVE-2023-28530 | Medium | 5.4 | 2023-07-22 | IBM Cognos Analytics 11.1 and 11.2 is vulnerable to stored cross-site scripting, caused by improper validation of SVG Files in Custom Visualizations. A remote… |
CVE-2023-25929 | Medium | 4.6 | 2023-07-22 | IBM Cognos Analytics 11.1 and 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2022-43910 | High | 8.4 | 2023-07-19 | IBM Security Guardium 11.3 could allow a local user to escalate their privileges due to improper permission controls. IBM X-Force ID: 240908. |
CVE-2023-29260 | Medium | 6.5 | 2023-07-19 | IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized re… |
CVE-2023-29259 | Low | 3.7 | 2023-07-19 | IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID… |
CVE-2023-28513 | Medium | 5.9 | 2023-07-19 | IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vuln… |
CVE-2023-27877 | Medium | 5.3 | 2023-07-19 | IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB se… |
CVE-2023-26026 | Medium | 5.3 | 2023-07-19 | Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to con… |
CVE-2023-26023 | Medium | 6.5 | 2023-07-19 | Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to con… |
CVE-2022-43908 | Medium | 4.3 | 2023-07-19 | IBM Security Guardium 11.3 could allow an authenticated user to cause a denial of service due to improper input validation. IBM X-Force ID: 240903. |
CVE-2021-38933 | Medium | 5.9 | 2023-07-19 | IBM Sterling Connect:Direct for UNIX 1.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2023-35900 | Medium | 4.3 | 2023-07-19 | IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version information which may… |
CVE-2023-35898 | Medium | 4.3 | 2023-07-19 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information due to an insecure security configuration in InfoSpher… |
CVE-2023-33832 | Medium | 6.2 | 2023-07-19 | IBM Spectrum Protect 8.1.0.0 through 8.1.17.0 could allow a local user to cause a denial of service due to due to improper time-of-check to time-of-use functio… |
CVE-2023-30433 | Medium | 6.5 | 2023-07-19 | IBM Security Verify Access 10.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a spe… |
CVE-2023-35012 | Medium | 6.7 | 2023-07-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by… |
CVE-2023-35901 | Low | 2.7 | 2023-07-17 | IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid chang… |
CVE-2023-33857 | Medium | 5.3 | 2023-07-17 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain system information using a specially crafted query that could aid in further att… |
CVE-2023-30989 | High | 8.4 | 2023-07-16 | IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability. A malicious actor with command line access to the host… |
CVE-2023-30988 | High | 8.4 | 2023-07-16 | The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor with command line acce… |
CVE-2023-30449 | High | 7.5 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query. IBM… |
CVE-2023-30448 | Medium | 5.9 | 2023-07-10 | IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30447 | Medium | 5.9 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30446 | Medium | 5.9 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30445 | High | 7.5 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query on cer… |
CVE-2023-30442 | Medium | 5.9 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash w… |
CVE-2023-30431 | High | 8.4 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 db2set is vulnerable to a buffer overflow, caused by improper bounds che… |
CVE-2023-29256 | Medium | 5.3 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to an information disclosure due to improper privilege man… |
CVE-2023-28958 | High | 7.0 | 2023-07-10 | IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the sy… |
CVE-2023-28955 | Medium | 6.5 | 2023-07-10 | IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service… |
CVE-2023-28953 | Low | 3.1 | 2023-07-10 | IBM Cognos Analytics on Cloud Pak for Data 4.0 could allow an attacker to make system calls that might compromise the security of the containers due to misconf… |
CVE-2023-27869 | Medium | 6.3 | 2023-07-10 | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the syste… |
CVE-2023-27868 | Medium | 6.3 | 2023-07-10 | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the syste… |
CVE-2023-27867 | Medium | 6.3 | 2023-07-10 | IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Inj… |
CVE-2023-27558 | High | 8.4 | 2023-07-10 | IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path… |
CVE-2023-27540 | Medium | 5.9 | 2023-07-10 | IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specif… |
CVE-2023-23487 | Medium | 4.3 | 2023-07-10 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID: 245918. |
CVE-2021-39014 | Medium | 6.4 | 2023-07-07 | IBM Cloud Object System 3.15.8.97 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2023-35890 | Medium | 5.1 | 2023-07-07 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X… |
CVE-2023-30990 | High | 8.6 | 2023-07-04 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. IBM X-Force ID: 25… |
CVE-2023-27866 | Medium | 6.3 | 2023-06-28 | IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver d… |
CVE-2023-30993 | Medium | 6.8 | 2023-06-27 | IBM Cloud Pak for Security (CP4S) 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's acco… |
CVE-2023-23468 | Medium | 5.1 | 2023-06-27 | IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to insufficient security configuration which may a… |
CVE-2023-22593 | Medium | 4.0 | 2023-06-27 | IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.7.3 and 23.0.0 through 23.0.3 is vulnerable to security misconfiguration of the Redis contain… |
CVE-2023-26276 | Medium | 5.9 | 2023-06-27 | IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID… |
CVE-2023-26274 | Medium | 4.6 | 2023-06-27 | IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2023-26273 | Medium | 4.3 | 2023-06-27 | IBM QRadar SIEM 7.5.0 could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 248134. |
CVE-2022-34352 | Medium | 6.5 | 2023-06-27 | IBM QRadar SIEM 7.5.0 is vulnerable to information exposure allowing a delegated Admin tenant user with a specific domain security profile assigned to see dat… |
CVE-2023-32339 | Medium | 6.1 | 2023-06-27 | IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |