IBM
Page 26 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22436 | Medium | 5.4 | 2022-04-21 | IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2022-22435 | Medium | 5.4 | 2022-04-21 | IBM Maximo Asset Management 7.6.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2021-39078 | Medium | 4.4 | 2022-04-19 | IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215589. |
CVE-2021-39076 | High | 7.5 | 2022-04-19 | IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-For… |
CVE-2021-39072 | Medium | 5.9 | 2022-04-19 | IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Securi… |
CVE-2021-39033 | Medium | 6.5 | 2022-04-19 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information… |
CVE-2022-22391 | Medium | 4.3 | 2022-04-14 | IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they sh… |
CVE-2021-39068 | Medium | 5.4 | 2022-04-11 | IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2021-38930 | High | 7.5 | 2022-04-11 | IBM System Storage DS8000 Management Console (HMC) R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive informa… |
CVE-2021-38929 | High | 7.5 | 2022-04-11 | IBM System Storage DS8000 Management Console (HMC) R8.5 88.5x.x.x, R9.1 89.1x.0.0, and R9.2 89.2x.0.0 could allow a remote attacker to obtain sensitive informa… |
CVE-2022-22339 | High | 7.3 | 2022-04-08 | IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the… |
CVE-2020-4668 | High | 8.8 | 2022-04-08 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.3, and 6.1.1.0 is vulnerable to cross-site request forgery which co… |
CVE-2022-22410 | High | 7.2 | 2022-04-06 | IBM Watson Query with Cloud Pak for Data as a Service could allow an authenticated user to obtain sensitive information that would allow them to examine or alt… |
CVE-2022-22356 | Medium | 6.5 | 2022-04-05 | IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attemp… |
CVE-2022-22355 | Medium | 5.3 | 2022-04-05 | IBM MQ Appliance 9.2 CD and 9.2 LTS are vulnerable to a denial of service in the Login component of the application which could allow an attacker to cause a dr… |
CVE-2022-22404 | Medium | 6.5 | 2022-04-01 | IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1) may be vulnerable to d… |
CVE-2022-22332 | High | 7.5 | 2022-04-01 | IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-… |
CVE-2022-22331 | High | 7.1 | 2022-04-01 | IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an in… |
CVE-2022-22328 | Medium | 6.2 | 2022-04-01 | IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to another users data… |
CVE-2022-22327 | High | 7.5 | 2022-04-01 | IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2022-22311 | Medium | 6.5 | 2022-03-31 | IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to i… |
CVE-2022-22772 | High | 8.5 | 2022-03-30 | The cfsend, cfrecv, and CyberResp components of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX and TIBCO Managed File Transfer Plat… |
CVE-2003-5003 | Medium | 5.0 | 2022-03-28 | A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is the Update Handler. The manipulation with… |
CVE-2003-5002 | Low | 3.7 | 2022-03-28 | A vulnerability was found in ISS BlackICE PC Protection. It has been declared as problematic. Affected by this vulnerability is the component Update Handler wh… |
CVE-2003-5001 | Medium | 5.3 | 2022-03-28 | A vulnerability was found in ISS BlackICE PC Protection and classified as critical. Affected by this issue is the component Cross Site Scripting Detection. The… |
CVE-2022-22374 | Critical | 9.1 | 2022-03-24 | The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to operate its host. IBM… |
CVE-2022-22316 | Medium | 6.5 | 2022-03-23 | IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to incorrectly configured authorization c… |
CVE-2022-22394 | High | 8.8 | 2022-03-21 | The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by improper enforcement of access controls. By… |
CVE-2021-39046 | Medium | 4.9 | 2022-03-18 | IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 and IBM Business Process Manager 8.5 and 8.6 stores user credentials in plain clear text which can… |
CVE-2021-29899 | Medium | 6.5 | 2022-03-18 | IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service. IBM X-Force ID: 207413. |
CVE-2020-4989 | Medium | 4.3 | 2022-03-15 | IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 and IBM Rational Team Concert 6.0.6 and 6.0.0.1 could allow an authenticated user to obtain sensitive… |
CVE-2022-22354 | High | 7.5 | 2022-03-14 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection whic… |
CVE-2022-22353 | Medium | 6.5 | 2022-03-14 | IBM Big SQL on IBM Cloud Pak for Data 7.1.0, 7.1.1, 7.2.0, and 7.2.3 could allow an authenticated user with appropriate permissions to obtain sensitive informa… |
CVE-2022-22348 | Low | 2.4 | 2022-03-14 | IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Opera… |
CVE-2022-22346 | High | 8.8 | 2022-03-14 | IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malici… |
CVE-2022-22344 | Medium | 6.1 | 2022-03-14 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers… |
CVE-2021-39055 | Medium | 5.4 | 2022-03-14 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2021-39051 | Medium | 6.5 | 2022-03-14 | IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registr… |
CVE-2021-38971 | Medium | 4.9 | 2022-03-14 | IBM Data Virtualization on Cloud Pak for Data 1.3.0, 1.4.1, 1.5.0, 1.7.1 and 1.7.3 could allow an authorized user to bypass data masking rules and obtain sensi… |
CVE-2021-39025 | Medium | 5.3 | 2022-03-10 | IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 could disclose internal IP address information when the web backend is down. IBM X-Force 213863. |
CVE-2021-39022 | High | 8.8 | 2022-03-10 | IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or i… |
CVE-2021-38910 | Medium | 5.3 | 2022-03-10 | IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By… |
CVE-2022-22351 | High | 8.6 | 2022-03-07 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged trusted host user to exploit a vulnerability in the nimsh daemon to cause a denial of service… |
CVE-2021-38989 | Medium | 5.5 | 2022-03-07 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2021-38988 | Medium | 5.5 | 2022-03-07 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2022-22350 | Medium | 5.5 | 2022-03-02 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 220… |
CVE-2021-38996 | Medium | 5.5 | 2022-03-02 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2022-22321 | Medium | 5.5 | 2022-03-01 | IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. IBM X-Force ID: 218368. |
CVE-2021-38986 | Medium | 5.4 | 2022-03-01 | IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system… |
CVE-2021-38955 | Medium | 4.4 | 2022-03-01 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user with elevated privileges to cause a denial of service due to a file creation vulnerability in the… |
CVE-2020-4925 | Medium | 5.5 | 2022-03-01 | A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with requests and preventing the daemon to servi… |
CVE-2021-38993 | Medium | 5.5 | 2022-02-25 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the smbcd daemon to cause a denial of service. IBM X-… |
CVE-2022-22349 | Medium | 4.3 | 2022-02-24 | IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuratio… |
CVE-2021-39038 | Medium | 5.4 | 2022-02-24 | IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clickin… |
CVE-2021-38995 | Medium | 5.5 | 2022-02-24 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2021-38994 | Medium | 5.5 | 2022-02-24 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2022-22336 | High | 7.5 | 2022-02-23 | IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing… |
CVE-2022-22333 | Medium | 6.5 | 2022-02-23 | IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow, due to the Jetty base… |
CVE-2022-22308 | High | 7.8 | 2022-02-21 | IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application c… |
CVE-2022-25256 | Medium | 6.1 | 2022-02-19 | SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list… |
CVE-2021-39026 | Medium | 5.9 | 2022-02-18 | IBM Guardium Data Encryption (GDE) 5.0.0.2 and 5.0.0.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable… |
CVE-2021-38935 | High | 7.5 | 2022-02-18 | IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user… |
CVE-2021-39034 | High | 7.5 | 2022-02-17 | IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. IBM X-Force ID: 213964. |
CVE-2019-4352 | Low | 2.4 | 2022-02-16 | IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494. |
CVE-2019-4351 | Medium | 4.6 | 2022-02-16 | IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. IBM X-Force ID: 161493. |
CVE-2019-4291 | Medium | 6.5 | 2022-02-16 | IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions. IBM X-Force ID: 16069… |
CVE-2021-39080 | Medium | 6.5 | 2022-02-14 | Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codeba… |
CVE-2021-39079 | Medium | 5.4 | 2022-02-14 | IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar… |
CVE-2021-38960 | High | 7.5 | 2022-02-04 | IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047. |
CVE-2021-39021 | Medium | 5.3 | 2022-02-02 | IBM Guardium Data Encryption (GDE) 5.0.0.2 behaves differently or sends different responses under different circumstances in a way that is observable to an una… |
CVE-2021-39070 | Critical | 9.8 | 2022-02-02 | IBM Security Verify Access 10.0.0.0, 10.0.1.0 and 10.0.2.0 with the advanced access control authentication service enabled could allow an attacker to authentic… |
CVE-2021-39066 | High | 8.8 | 2022-02-02 | IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated se… |
CVE-2021-39044 | High | 8.8 | 2022-02-02 | IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2021-29846 | Low | 2.7 | 2022-01-26 | IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 20… |
CVE-2021-29845 | High | 8.8 | 2022-01-26 | IBM Security Guardium Insights 3.0 could allow an authenticated user to perform unauthorized actions due to improper input validation. IBM X-Force ID: 205255. |
CVE-2021-29838 | Medium | 5.9 | 2022-01-26 | IBM Security Guardium Insights 3.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpor… |
CVE-2021-39031 | High | 8.8 | 2022-01-25 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a speci… |
CVE-2020-4879 | Critical | 9.8 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication… |
CVE-2020-4877 | Critical | 9.8 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. IBM X-Force ID: 19… |
CVE-2020-4876 | High | 8.2 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2020-4875 | High | 8.2 | 2022-01-21 | IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2021-29785 | Medium | 5.9 | 2022-01-20 | IBM Security SOAR V42 and V43could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Secu… |
CVE-2022-22310 | Medium | 6.5 | 2022-01-19 | IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A remote attacker could exploit this weakness… |
CVE-2021-29872 | Medium | 5.4 | 2022-01-18 | IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of… |
CVE-2021-38965 | High | 8.8 | 2022-01-17 | IBM FileNet Content Manager 5.5.4, 5.5.6, and 5.5.7 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specia… |
CVE-2021-39032 | Medium | 5.5 | 2022-01-14 | IBM Sterling Gentran:Server for Microsoft Windows 5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID… |
CVE-2021-39056 | Medium | 6.5 | 2022-01-13 | The IBM i 7.1, 7.2, 7.3, and 7.4 Extended Dynamic Remote SQL server (EDRSQL) could allow a remote authenticated user to send a specially crafted request and ca… |
CVE-2021-38991 | High | 7.8 | 2022-01-11 | IBM AIX 7.0, 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the lscore command which could lead to code execution… |
CVE-2021-29701 | Medium | 4.3 | 2022-01-11 | IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 as well as IBM Rational Team Concert 6.0.6 and 6.0.6.1 could allow an authneticated attacker to obtai… |
CVE-2021-38990 | High | 7.8 | 2022-01-10 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead to code execution. IBM… |
CVE-2021-38957 | High | 7.5 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive information due to hazardous input validation during QR code generation. IBM X-Forc… |
CVE-2021-38956 | Medium | 5.3 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive version information in HTTP response headers that could aid in further attacks agai… |
CVE-2021-38921 | High | 7.5 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2021-38895 | Medium | 5.4 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-38894 | Low | 2.7 | 2022-01-10 | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret… |
CVE-2021-38918 | High | 7.5 | 2022-01-05 | IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM management operations could lead to a violation of the isolation betw… |
CVE-2021-38876 | Medium | 6.1 | 2021-12-30 | IBM i 7.2, 7.3, and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering t… |
CVE-2021-38961 | Medium | 6.1 | 2021-12-27 | IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int… |
CVE-2021-39013 | Medium | 6.5 | 2021-12-22 | IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could… |
CVE-2021-38966 | Medium | 5.4 | 2021-12-21 | IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |