IBM
Page 30 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20413 | Medium | 4.3 | 2021-06-28 | IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in… |
CVE-2021-29677 | Medium | 5.4 | 2021-06-25 | IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav… |
CVE-2021-29676 | Medium | 5.4 | 2021-06-25 | IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL l… |
CVE-2021-20583 | Medium | 4.9 | 2021-06-25 | IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) could disclose sensitive information through an HTTP GET request by a privileged user due to… |
CVE-2020-4610 | High | 7.8 | 2021-06-25 | IBM Security Secret Server (IBM Security Verify Privilege Manager 10.8.2 ) could allow a local user to execute code due to improper integrity checks. IBM X-For… |
CVE-2020-4609 | High | 7.8 | 2021-06-25 | IBM Security Sevret Server (IBM Security Verify Privilege Manager 10.8.2) is vulnerable to a buffer overflow, caused by improper bounds checking. A local attac… |
CVE-2021-29777 | Medium | 6.5 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while b… |
CVE-2021-29703 | High | 7.5 | 2021-06-24 | Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server terminates abnormally when executing a special… |
CVE-2021-20579 | Medium | 6.5 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL functi… |
CVE-2020-4945 | High | 8.1 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to improper group perm… |
CVE-2020-4885 | Medium | 4.7 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of Db2 due to a race con… |
CVE-2021-29706 | High | 7.1 | 2021-06-17 | IBM AIX 7.1 could allow a non-privileged local user to exploit a vulnerability in the trace facility to expose sensitive information or cause a denial of servi… |
CVE-2021-29702 | High | 7.5 | 2021-06-16 | Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminates abnormally when e… |
CVE-2021-20567 | Medium | 4.4 | 2021-06-16 | IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.IBM X-Force ID: 1992… |
CVE-2021-20566 | High | 7.5 | 2021-06-16 | IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force I… |
CVE-2021-20488 | Medium | 6.5 | 2021-06-16 | IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM S… |
CVE-2021-20483 | Medium | 6.5 | 2021-06-16 | IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacke… |
CVE-2020-5000 | Medium | 5.4 | 2021-06-15 | IBM Financial Transaction Manager 3.2.0 through 3.2.8 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2021-29754 | High | 8.8 | 2021-06-11 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inbound Trust Association… |
CVE-2021-20396 | Low | 3.3 | 2021-06-11 | IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. I… |
CVE-2020-5003 | Critical | 9.1 | 2021-06-11 | IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploi… |
CVE-2021-20517 | High | 8.8 | 2021-06-07 | IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a s… |
CVE-2020-5008 | Medium | 5.3 | 2021-06-07 | IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to inf… |
CVE-2021-20380 | High | 7.5 | 2021-06-03 | IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain sensitive information from HTTP requests… |
CVE-2021-29670 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-29668 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2021-20371 | Medium | 6.5 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser… |
CVE-2021-20348 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unautho… |
CVE-2021-20347 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unautho… |
CVE-2021-20346 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unautho… |
CVE-2021-20345 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unautho… |
CVE-2021-20343 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unautho… |
CVE-2021-20338 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-5030 | Medium | 5.4 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4977 | Medium | 5.4 | 2021-06-02 | IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2020-4732 | Medium | 6.5 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-… |
CVE-2020-4495 | High | 8.8 | 2021-06-02 | IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a… |
CVE-2021-29740 | High | 7.8 | 2021-06-01 | IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerability. An attacker cou… |
CVE-2021-29665 | High | 7.8 | 2021-06-01 | IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow a local attacker to execu… |
CVE-2021-20585 | Medium | 5.3 | 2021-06-01 | IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Fo… |
CVE-2021-20576 | High | 7.5 | 2021-06-01 | IBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP GET request that could cause the application to crash. |
CVE-2021-20575 | Low | 3.3 | 2021-06-01 | IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278. |
CVE-2020-4561 | Critical | 10.0 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access… |
CVE-2020-4520 | High | 8.8 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim would execute the c… |
CVE-2020-4354 | Medium | 5.4 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2020-4300 | High | 8.2 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2019-4730 | High | 7.1 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2019-4724 | High | 7.5 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Content… |
CVE-2019-4723 | High | 7.5 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data Se… |
CVE-2019-4722 | Medium | 4.3 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information via a stack trace due to mishandling of certain error conditio… |
CVE-2019-4653 | Medium | 5.4 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2019-4471 | Medium | 6.5 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive… |
CVE-2021-20492 | High | 8.2 | 2021-05-26 | IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data… |
CVE-2021-20487 | Critical | 9.1 | 2021-05-26 | IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host fi… |
CVE-2021-20486 | Medium | 6.5 | 2021-05-26 | IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. IBM X-Force ID: 197668. |
CVE-2019-4588 | High | 7.8 | 2021-05-26 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to execute arbitrary code and conduc… |
CVE-2021-29708 | Medium | 6.7 | 2021-05-25 | IBM Spectrum Scale 5.1.0.1 could allow a local with access to the GUI pod container to obtain sensitive cryptographic keys that could allow them to elevate the… |
CVE-2021-29695 | Medium | 6.5 | 2021-05-25 | IBM Host firmware for LC-class Systems could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL requ… |
CVE-2020-4839 | Medium | 4.9 | 2021-05-25 | IBM Host firmware for LC-class Systems is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A remote privileged attacker could e… |
CVE-2021-20557 | High | 7.2 | 2021-05-24 | IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM… |
CVE-2021-20428 | Medium | 5.3 | 2021-05-24 | IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. Th… |
CVE-2021-20426 | Critical | 9.8 | 2021-05-24 | IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2021-20419 | High | 7.5 | 2021-05-24 | IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2021-20389 | High | 7.8 | 2021-05-24 | IBM Security Guardium 11.2 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 195770. |
CVE-2021-20386 | Medium | 6.1 | 2021-05-24 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2021-20385 | High | 7.2 | 2021-05-24 | IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an… |
CVE-2020-4990 | High | 8.8 | 2021-05-24 | IBM Security Guardium 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to vie… |
CVE-2021-29681 | Medium | 5.3 | 2021-05-21 | IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information by injecting parameters into an HTML query. This information cou… |
CVE-2021-29692 | Medium | 5.9 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2021-29691 | High | 7.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2021-29688 | High | 7.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the br… |
CVE-2021-29687 | Medium | 5.3 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IB… |
CVE-2021-29686 | High | 8.8 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have access to. IBM X-Force I… |
CVE-2021-29683 | Medium | 6.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 199998. |
CVE-2021-29682 | Medium | 5.3 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the br… |
CVE-2020-4850 | High | 7.5 | 2021-05-20 | IBM Spectrum Scale 1.1.1.0 through 1.1.8.4 Transparent Cloud Tiering could allow a remote attacker to obtain sensitive information, caused by the leftover file… |
CVE-2021-20529 | Medium | 5.3 | 2021-05-19 | IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM X-Force ID… |
CVE-2021-20528 | Medium | 5.4 | 2021-05-19 | IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2021-20374 | Medium | 5.4 | 2021-05-19 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4765 | Low | 3.3 | 2021-05-19 | IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188… |
CVE-2020-4646 | Medium | 4.3 | 2021-05-19 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5, 6.0.0.0 through 6.0.3.3, and 6.1.0.0 through 6.1.0.2 could allow an authenticated user to… |
CVE-2021-29747 | High | 7.5 | 2021-05-17 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain highly sensitive information due to a vulnerability in the authentication mechan… |
CVE-2020-4670 | Critical | 9.1 | 2021-05-17 | IBM Planning Analytics Local 2.0 connects to a Redis server. The Redis server, an in-memory data structure store, running on the remote host is not protected b… |
CVE-2020-4669 | Critical | 9.1 | 2021-05-17 | IBM Planning Analytics Local 2.0 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configu… |
CVE-2021-20565 | Medium | 5.3 | 2021-05-14 | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 uses a protection mechanism that relies on the existence or values of an inpu… |
CVE-2021-20564 | Medium | 5.9 | 2021-05-14 | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive information, caused by the… |
CVE-2021-20429 | Medium | 5.3 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could disclose sensitive information due an overly permissive cross-domain policy. IBM X-Force ID: 19633… |
CVE-2021-20393 | High | 7.5 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2021-20392 | Medium | 6.1 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod… |
CVE-2021-20391 | Low | 3.3 | 2021-05-14 | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 1… |
CVE-2020-4985 | High | 7.5 | 2021-05-14 | IBM Planning Analytics Local 2.0 could allow an attacker to obtain sensitive information due to accepting body parameters in a query. IBM X-Force ID: 192642. |
CVE-2020-4811 | Low | 2.4 | 2021-05-14 | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious data using a special… |
CVE-2021-20535 | Medium | 5.4 | 2021-05-13 | IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send… |
CVE-2020-4536 | Medium | 4.3 | 2021-05-11 | IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2020-4535 | Medium | 5.4 | 2021-05-11 | IBM OpenPages GRC Platform 8.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2021-20577 | Medium | 6.1 | 2021-05-10 | IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2021-20559 | Medium | 5.4 | 2021-05-10 | IBM Control Desk 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2021-20538 | Critical | 9.1 | 2021-05-10 | IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due… |
CVE-2020-4901 | Medium | 6.5 | 2021-05-07 | IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on the network to obtain sensitive information or cause a denial of servic… |
CVE-2020-28198 | High | 7.0 | 2021-05-06 | The 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 (Command Line Administrative Interface, dsmadmc.exe) is vulnerable to an exploitable stack… |