IBM
Page 22 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4927 | Medium | 5.7 | 2023-03-15 | A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the… |
CVE-2020-4556 | Medium | 4.0 | 2023-03-15 | IBM Financial Transaction Manager for High Value Payments for Multi-Platform 3.2.0 through 3.2.10 allows web pages to be stored locally which can be read by an… |
CVE-2023-26284 | High | 7.5 | 2023-03-15 | IBM MQ Certified Container 9.3.0.1 through 9.3.0.3 and 9.3.1.0 through 9.3.1.1 could allow authenticated users with the cluster to be granted administration ac… |
CVE-2022-43874 | Medium | 6.1 | 2023-03-15 | IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, 6.2, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows… |
CVE-2023-24975 | Medium | 5.4 | 2023-03-10 | IBM Spectrum Symphony 7.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to… |
CVE-2022-43902 | Medium | 6.5 | 2023-03-10 | IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS is vulnerable to a denial of service attack caused by specially crafted PCF or MQSC messages. IBM X-Force ID: 240… |
CVE-2020-5002 | Medium | 4.3 | 2023-03-10 | IBM Financial Transaction Manager 3.2.0 through 3.2.10 could allow an authenticated user to perform unauthorized actions due to improper validation. IBM X-For… |
CVE-2023-27290 | Critical | 9.1 | 2023-03-03 | Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentic… |
CVE-2022-35645 | Medium | 6.4 | 2023-03-02 | IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and IBM Maximo Application Suite 8.8 and 8.9 is vulnerable to stored cross-site scripting. This vulnerabi… |
CVE-2020-5026 | Medium | 4.3 | 2023-03-01 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitive information whe… |
CVE-2020-5001 | Medium | 4.3 | 2023-03-01 | IBM Financial Transaction Manager 3.2.0 through 3.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-… |
CVE-2023-26281 | Medium | 5.9 | 2023-03-01 | IBM HTTP Server 8.5 used by IBM WebSphere Application Server could allow a remote user to cause a denial of service using a specially crafted URL. IBM X-Force… |
CVE-2023-22860 | Medium | 5.4 | 2023-02-27 | IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vul… |
CVE-2022-40237 | Medium | 6.5 | 2023-02-27 | IBM MQ for HPE NonStop 8.1.0 is vulnerable to a denial of service attack due to an error within the CCDT and channel synchronization logic. IBM X-Force ID: 2… |
CVE-2022-43923 | Medium | 6.2 | 2023-02-24 | IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local user. IBM X-Force ID: 241584. |
CVE-2022-43873 | Medium | 6.3 | 2023-02-22 | An authenticated user can exploit a vulnerability in the IBM Spectrum Virtualize 8.2, 8.3, 8.4, and 8.5 GUI to execute code and escalate their privilege on the… |
CVE-2022-43870 | Medium | 6.5 | 2023-02-22 | IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticated user in log files. IBM X-Force ID: 239540. |
CVE-2022-43578 | Medium | 4.6 | 2023-02-22 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2023-25928 | Medium | 4.6 | 2023-02-21 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2023-24960 | High | 7.5 | 2023-02-17 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL requ… |
CVE-2022-43579 | Medium | 4.6 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2022-40231 | Medium | 4.3 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 could allow an authenticated user to perform unauthorized acti… |
CVE-2022-34351 | Medium | 5.9 | 2023-02-17 | IBM QRadar SIEM 7.4 and 7.5 is vulnerable to information exposure allowing a non-tenant user with a specific domain security profile assigned to see some data… |
CVE-2022-43930 | Medium | 6.2 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IB… |
CVE-2022-41734 | Medium | 5.3 | 2023-02-17 | IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2022-40232 | Medium | 6.3 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.1.0.0 through 6.1.1.1, and 6.1.2.0 could allow an authenticated user to perform actions they should not have ac… |
CVE-2023-24964 | Medium | 6.2 | 2023-02-17 | IBM InfoSphere Information Server 11.7 could allow a local user to obtain sensitive information from a log files. IBM X-Force ID: 246463. |
CVE-2023-22868 | Medium | 5.4 | 2023-02-17 | IBM Aspera Faspex 4.4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t… |
CVE-2022-43929 | Medium | 4.9 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted 'Load' command. IBM X-Force ID… |
CVE-2022-43927 | Medium | 5.9 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted… |
CVE-2022-36775 | Medium | 6.5 | 2023-02-17 | IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input b… |
CVE-2022-47986 | Critical | 9.8 | 2023-02-17 | IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw… |
CVE-2022-43869 | Medium | 6.5 | 2023-02-12 | IBM Spectrum Scale (5.1.0.0 through 5.1.2.8 and 5.1.3.0 through 5.1.5.1) and IBM Elastic Storage System (6.1.0.0 through 6.1.2.4 and 6.1.3.0 through 6.1.4.1) c… |
CVE-2022-42444 | Medium | 4.9 | 2023-02-12 | IBM App Connect Enterprise 11.0.0.8 through 11.0.0.19 and 12.0.1.0 through 12.0.5.0 is vulnerable to a buffer overflow. A remote privileged user could overflow… |
CVE-2022-42436 | Medium | 4.0 | 2023-02-12 | IBM MQ 8.0.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0 Managed File Transfer could allow a local user to obtain sensitive information from diagnostic files. IBM X-Force ID… |
CVE-2022-41731 | High | 8.6 | 2023-02-12 | IBM Watson Knowledge Catalog on Cloud Pak for Data 4.5.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which c… |
CVE-2022-34350 | Medium | 5.3 | 2023-02-08 | IBM API Connect 10.0.0.0 through 10.0.5.0, 10.0.1.0 through 10.0.1.7, and 2018.4.1.0 through 2018.4.1.20 is vulnerable to External Service Interaction attack… |
CVE-2023-23475 | Medium | 4.6 | 2023-02-08 | IBM Infosphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-42438 | High | 7.5 | 2023-02-08 | IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM… |
CVE-2022-35720 | Low | 2.3 | 2023-02-08 | IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation th… |
CVE-2022-34362 | Medium | 4.6 | 2023-02-08 | IBM Sterling Secure Proxy 6.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attack… |
CVE-2022-42439 | Medium | 6.8 | 2023-02-06 | IBM App Connect Enterprise 11.0.0.17 through 11.0.0.19 and 12.0.4.0 and 12.0.5.0 contains an unspecified vulnerability in the Discovery Connector nodes which… |
CVE-2023-23477 | High | 8.1 | 2023-02-03 | IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequenc… |
CVE-2022-38389 | High | 7.1 | 2023-02-03 | IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2022-22486 | Critical | 10.0 | 2023-02-03 | IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2023-23469 | Medium | 4.0 | 2023-02-01 | IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 al… |
CVE-2022-47983 | Medium | 5.4 | 2023-02-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-43922 | Medium | 5.3 | 2023-02-01 | IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, and 6.2 could disclose sensitive information to an attacker due to a weak has… |
CVE-2022-43917 | Medium | 5.9 | 2023-01-26 | IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensit… |
CVE-2022-43864 | High | 7.5 | 2023-01-26 | IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL re… |
CVE-2022-22462 | Low | 3.7 | 2023-01-26 | IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an att… |
CVE-2022-41733 | Medium | 5.3 | 2023-01-20 | IBM InfoSphere Information Server 11.7 could allow a remote attacked to cause some of the components to be unusable until the process is restarted. IBM X-Forc… |
CVE-2021-39089 | Medium | 4.3 | 2023-01-20 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP req… |
CVE-2021-39011 | Medium | 4.2 | 2023-01-20 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive information in log files that could be read by a privileged user. IBM… |
CVE-2022-39167 | Medium | 5.9 | 2023-01-19 | IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle… |
CVE-2023-22863 | Medium | 5.9 | 2023-01-18 | IBM Robotic Process Automation 20.12.0 through 21.0.2 defaults to HTTP in some RPA commands when the prefix is not explicitly specified in the URL. This could… |
CVE-2023-22594 | Medium | 4.6 | 2023-01-18 | IBM Robotic Process Automation for Cloud Pak 20.12.0 through 21.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2023-22592 | Medium | 4.0 | 2023-01-18 | IBM Robotic Process Automation for Cloud Pak 21.0.1 through 21.0.4 could allow a local user to perform unauthorized actions due to insufficient permission set… |
CVE-2022-47990 | Medium | 6.2 | 2023-01-18 | IBM AIX 7.1, 7.2, 7.3 and VIOS , 3.1 could allow a non-privileged local user to exploit a vulnerability in X11 to cause a buffer overflow that could result in… |
CVE-2023-22875 | High | 8.4 | 2023-01-17 | IBM QRadar SIEM 7.4 and 7.5copies certificate key files used for SSL/TLS in the QRadar web user interface to managed hosts in the deployment that do not requi… |
CVE-2022-40615 | Medium | 6.3 | 2023-01-11 | IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, whi… |
CVE-2022-34335 | Medium | 6.5 | 2023-01-11 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.1 could allow an authenticated user to exhaust server resources which could lead to a denial of… |
CVE-2022-35281 | Medium | 5.5 | 2023-01-09 | IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV inje… |
CVE-2022-22470 | Medium | 4.1 | 2023-01-09 | IBM Security Verify Governance 10.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225232. |
CVE-2022-43844 | High | 8.8 | 2023-01-05 | IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform… |
CVE-2022-43573 | Low | 3.1 | 2023-01-05 | IBM Robotic Process Automation 20.12 through 21.0.6 is vulnerable to exposure of the name and email for the creator/modifier of platform level objects. IBM X-… |
CVE-2022-41740 | Medium | 4.6 | 2023-01-05 | IBM Robotic Process Automation 20.12 through 21.0.6 could allow an attacker with physical access to the system to obtain highly sensitive information from sys… |
CVE-2022-34330 | Medium | 6.1 | 2023-01-05 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |
CVE-2022-22371 | Medium | 5.5 | 2023-01-05 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated use… |
CVE-2022-43920 | Medium | 6.3 | 2023-01-04 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could allow an authenticated user to gain privileges in a different group due to an access… |
CVE-2022-22352 | Medium | 5.4 | 2023-01-04 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |
CVE-2022-22338 | Medium | 6.3 | 2023-01-04 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL stateme… |
CVE-2022-22337 | Medium | 4.3 | 2023-01-04 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could disclose sensitive information to an authenticated user. IBM X-Force ID: 219507. |
CVE-2021-38928 | Medium | 5.4 | 2023-01-04 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privi… |
CVE-2022-42435 | Medium | 4.3 | 2023-01-04 | IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to c… |
CVE-2022-43860 | Medium | 4.3 | 2022-12-24 | IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authorized to but not while using this interfa… |
CVE-2022-22449 | Medium | 5.3 | 2022-12-24 | IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2022-43849 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd kernel extension to cause a denial of se… |
CVE-2022-43848 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial o… |
CVE-2022-41290 | High | 8.4 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the rm_rlcache_file command to obtain root privileges… |
CVE-2022-39164 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2022-43381 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM… |
CVE-2022-43380 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to cause a denial of se… |
CVE-2022-40233 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX TCP/IP kernel extension to cause a denial of… |
CVE-2022-39165 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 23… |
CVE-2022-22458 | Medium | 6.3 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 stores user credentials in plain clear text which can be read by a remote authenticated user. IBM X-Fo… |
CVE-2022-22457 | Medium | 5.3 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a loca… |
CVE-2022-22456 | Medium | 4.2 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript c… |
CVE-2022-43859 | Medium | 6.3 | 2022-12-22 | IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information for an object they are authorized to but not while usin… |
CVE-2022-43858 | Medium | 4.3 | 2022-12-22 | IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to access the file system and download files they are authorized to but not while using… |
CVE-2022-43857 | Medium | 4.3 | 2022-12-22 | IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this… |
CVE-2022-35646 | Medium | 5.9 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 software component could allow an authenticated user to modify or cancel any other user's access reque… |
CVE-2022-22461 | Medium | 5.9 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2022-43382 | Medium | 6.2 | 2022-12-20 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a local user with elevated privileges to exploit a vulnerability in the lpd daemon to cause a denial of service… |
CVE-2022-39166 | Medium | 4.4 | 2022-12-20 | IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. IBM X-Force ID: 235405. |
CVE-2022-38391 | Medium | 5.1 | 2022-12-20 | IBM Spectrum Control 5.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2022-46771 | Medium | 4.6 | 2022-12-20 | IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.18, 7.0.5.0 through 7.0.5.13, 7.1.0.0 through 7.1.2.9, 7.2.0.0 through 7.2.3.2 and 7.3.0.0 is vulnerable to c… |
CVE-2022-43875 | Medium | 6.2 | 2022-12-20 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting… |
CVE-2022-43872 | Medium | 5.3 | 2022-12-20 | IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical informati… |
CVE-2022-43887 | Medium | 5.3 | 2022-12-19 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain… |