IBM
Page 29 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20427 | High | 7.5 | 2021-08-11 | IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 19… |
CVE-2021-20420 | Medium | 4.3 | 2021-08-11 | IBM Security Guardium 11.2 could disclose sensitive information due to reliance on untrusted inputs that could aid in further attacks against the system. IBM X… |
CVE-2021-20418 | Critical | 9.8 | 2021-08-11 | IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts… |
CVE-2021-29739 | Medium | 4.9 | 2021-08-10 | IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. X-Force ID: 19884… |
CVE-2021-29714 | Medium | 6.5 | 2021-08-09 | IBM Content Navigator 3.0.CD could allow a malicious user to cause a denial of service due to improper input validation. IBM X-Force ID: 200968. |
CVE-2021-20349 | Medium | 5.3 | 2021-08-09 | IBM Tivoli Workload Scheduler 9.4 and 9.5 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a… |
CVE-2021-29765 | High | 7.5 | 2021-08-04 | IBM PowerVM Hypervisor FW940 and FW950 could allow an attacker to obtain sensitive information if they gain service access to the FSP. IBM X-Force ID: 202476. |
CVE-2020-4707 | Medium | 5.4 | 2021-08-04 | IBM API Connect 5.0.0.0 through 5.0.8.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2021-29697 | Medium | 4.9 | 2021-08-02 | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive info… |
CVE-2021-29696 | High | 7.2 | 2021-08-02 | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to execute arbitrary com… |
CVE-2021-20541 | Medium | 5.3 | 2021-08-02 | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through… |
CVE-2021-20540 | Medium | 5.3 | 2021-08-02 | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through… |
CVE-2021-20539 | Medium | 5.3 | 2021-08-02 | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through… |
CVE-2021-29757 | High | 8.8 | 2021-08-02 | IBM QRadar User Behavior Analytics 4.1.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized action… |
CVE-2021-29741 | High | 7.8 | 2021-08-02 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in Korn Shell (ksh) to gain root privileges. IBM X-Force ID: 201478. |
CVE-2021-29781 | Critical | 9.8 | 2021-07-30 | IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending… |
CVE-2021-29736 | High | 8.8 | 2021-07-30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: 201300. |
CVE-2021-20505 | Medium | 4.4 | 2021-07-29 | The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be compromised. If an atta… |
CVE-2020-5004 | Medium | 5.4 | 2021-07-28 | IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2020-4974 | Medium | 6.3 | 2021-07-28 | IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from… |
CVE-2021-20562 | Medium | 5.4 | 2021-07-27 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allow… |
CVE-2021-20399 | Critical | 9.1 | 2021-07-27 | IBM Qradar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote… |
CVE-2021-29784 | Medium | 4.3 | 2021-07-26 | IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2021-29770 | Medium | 6.5 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow an authenticated user to perform unauthorized actions due to hazardous i… |
CVE-2021-29769 | Medium | 4.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authorization tokens or session cookies. Attack… |
CVE-2021-29767 | Medium | 5.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message… |
CVE-2021-29766 | Medium | 5.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed techni… |
CVE-2021-20560 | Medium | 5.4 | 2021-07-26 | IBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and 1.5.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading… |
CVE-2021-20431 | Medium | 6.5 | 2021-07-26 | IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive informa… |
CVE-2021-20430 | Medium | 5.3 | 2021-07-26 | IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed techni… |
CVE-2021-20337 | High | 7.5 | 2021-07-26 | IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2020-4623 | Medium | 6.5 | 2021-07-26 | IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a… |
CVE-2021-20478 | Low | 3.3 | 2021-07-20 | IBM Cloud Pak System 2.3 could allow a local user in some situations to view the artifacts of another user in self service console. IBM X-Force ID: 197497. |
CVE-2021-29780 | Medium | 4.7 | 2021-07-19 | IBM Resilient OnPrem v41.1 of IBM Security SOAR could allow an authenticated user to perform actions that they should not have access to due to improper input… |
CVE-2021-29707 | High | 7.8 | 2021-07-19 | IBM HMC (Hardware Management Console) V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM… |
CVE-2021-20507 | Medium | 5.4 | 2021-07-19 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-5031 | Medium | 5.4 | 2021-07-19 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4980 | Medium | 6.5 | 2021-07-16 | IBM QRadar SIEM 7.3 and 7.4 uses less secure methods for protecting data in transit between hosts when encrypt host connections is not enabled as well as data… |
CVE-2020-4821 | Critical | 9.8 | 2021-07-16 | IBM InfoSphere Data Replication 11.4 and IBM InfoSphere Change Data Capture for z/OS 10.2.1, under certain configurations, could allow a user to bypass authent… |
CVE-2020-4675 | Medium | 6.5 | 2021-07-16 | IBM InfoSphere Master Data Management Server 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2021-29742 | High | 8.0 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a user to impersonate another user on the system. IBM X-Force ID: 201483. |
CVE-2021-29699 | Medium | 6.8 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote priviled user to upload arbitrary files with a dangerous file type that could be excuted by an us… |
CVE-2021-20537 | Medium | 6.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentica… |
CVE-2021-20534 | Low | 3.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vi… |
CVE-2021-20533 | High | 7.2 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted… |
CVE-2021-20524 | Medium | 4.8 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2021-20523 | Low | 2.7 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in t… |
CVE-2021-20511 | Medium | 4.9 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL re… |
CVE-2021-20510 | Medium | 4.4 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 198299 |
CVE-2021-20500 | Medium | 4.4 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could reveal highly sensitive information to a local privileged user. IBM X-Force ID: 197980. |
CVE-2021-20499 | Low | 2.7 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in t… |
CVE-2021-20498 | Medium | 5.3 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID… |
CVE-2021-20497 | High | 7.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informatio… |
CVE-2021-20496 | Medium | 4.9 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation. IBM X-Force ID: 197966. |
CVE-2021-29749 | Medium | 5.4 | 2021-07-15 | IBM Secure External Authentication Server 6.0.2 and IBM Secure Proxy 6.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated… |
CVE-2021-29725 | High | 7.5 | 2021-07-15 | IBM Secure External Authentication Server 2.4.3.2, 6.0.1, 6.0.2 and IBM Secure Proxy 3.4.3.2, 6.0.1, 6.0.2 could allow a remote user to consume resources causi… |
CVE-2021-20439 | High | 7.5 | 2021-07-15 | IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized u… |
CVE-2021-20424 | Medium | 4.3 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the bro… |
CVE-2021-20423 | High | 8.8 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 could allow an authenticated user gain escalated privilesges due to improper application permissions. IBM X-Force ID: 196308. |
CVE-2021-20422 | High | 7.5 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 could disclose sensitive information to a malicious attacker by accessing data stored in memory. IBM X-Force ID: 196304. |
CVE-2021-20369 | Medium | 5.9 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM… |
CVE-2021-20368 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20366 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20365 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20364 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20363 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20362 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20361 | Medium | 5.4 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2021-20360 | High | 7.5 | 2021-07-13 | IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM… |
CVE-2021-29822 | Medium | 5.4 | 2021-07-12 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2021-29805 | Medium | 5.4 | 2021-07-12 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2021-29804 | Medium | 5.4 | 2021-07-12 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2021-29803 | Medium | 5.4 | 2021-07-12 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2021-29794 | High | 7.5 | 2021-07-12 | IBM Tivoli Netcool/Impact 7.1.0.20 and 7.1.0.21 uses an insecure SSH server configuration which enables weaker than expected cryptographic algorithms that coul… |
CVE-2021-29792 | High | 7.2 | 2021-07-12 | IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain pri… |
CVE-2021-20414 | Medium | 4.9 | 2021-07-12 | IBM Guardium Data Encryption (GDE) 3.0.0.2 could allow a user to bruce force sensitive information due to not properly limiting the number of interactions. IBM… |
CVE-2020-4938 | High | 8.8 | 2021-07-12 | IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitte… |
CVE-2021-29730 | High | 8.8 | 2021-07-09 | IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att… |
CVE-2021-29712 | Medium | 6.1 | 2021-07-09 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2021-29711 | Medium | 4.3 | 2021-07-08 | IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 6.2.7.8 , 6.2.7.9, 7.0.3.0, 7.0.4.0, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2 could allow an authenticated… |
CVE-2021-29759 | Low | 2.3 | 2021-07-07 | IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, and 1.3 could allow a privileged user to obtain sensitive information from internal log files. IB… |
CVE-2021-20474 | High | 7.5 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user identity or consumes… |
CVE-2021-20417 | Medium | 4.3 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2021-20416 | Medium | 5.3 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly… |
CVE-2021-20415 | High | 7.5 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IB… |
CVE-2021-20379 | High | 7.5 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensit… |
CVE-2021-20378 | High | 8.8 | 2021-07-07 | IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another… |
CVE-2020-4935 | Medium | 5.4 | 2021-07-01 | IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2020-4902 | High | 8.8 | 2021-07-01 | IBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, whi… |
CVE-2021-20461 | Medium | 6.5 | 2021-06-30 | IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting. An attacker could potenti… |
CVE-2021-20580 | Medium | 4.3 | 2021-06-29 | IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery (CSRF) which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2021-20490 | Medium | 5.5 | 2021-06-29 | IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force ID… |
CVE-2021-20477 | Medium | 5.4 | 2021-06-29 | IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2021-29775 | Medium | 5.4 | 2021-06-28 | IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnera… |
CVE-2021-29751 | Medium | 4.3 | 2021-06-28 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive inform… |
CVE-2021-29693 | Medium | 4.4 | 2021-06-28 | IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user that is in the with elevated group privileges to cause a denial of service due to a vulnerability in th… |
CVE-2021-20574 | High | 8.8 | 2021-06-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted reque… |
CVE-2021-20573 | Medium | 6.5 | 2021-06-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote authenticated a… |
CVE-2021-20572 | Medium | 6.5 | 2021-06-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A remote authenticated… |
CVE-2021-20494 | Medium | 6.5 | 2021-06-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a heap based buffer overflow, caused by improper bounds. An authenticared user could overf… |