IBM
Page 31 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20401 | High | 7.8 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outboun… |
CVE-2021-20397 | Medium | 6.1 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2020-5013 | High | 8.1 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulne… |
CVE-2020-4993 | Medium | 4.9 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 when decompressing or verifying signature of zip files processes data in a way that may be vulnerable to path traversal attacks. IB… |
CVE-2020-4979 | Critical | 9.8 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. An attacker that is able to comprimise or spoof traffic between hosts may… |
CVE-2020-4932 | High | 7.8 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outboun… |
CVE-2020-4929 | Medium | 5.4 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2020-4883 | Medium | 6.5 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 could disclose sensitive information about other domains which could be used in further attacks against the system. IBM X-Force ID… |
CVE-2020-4987 | Medium | 5.4 | 2021-05-04 | The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and prior. This vulnera… |
CVE-2021-20515 | Medium | 6.7 | 2021-04-30 | IBM Informix Dynamic Server 14.10 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local privileged user could overflow a… |
CVE-2021-29667 | High | 7.8 | 2021-04-27 | IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary comman… |
CVE-2021-29666 | Medium | 5.4 | 2021-04-27 | IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja… |
CVE-2021-20550 | Medium | 5.4 | 2021-04-27 | IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2021-20549 | Medium | 5.4 | 2021-04-27 | IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2021-20448 | Medium | 5.4 | 2021-04-27 | IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2020-4981 | Medium | 6.0 | 2021-04-27 | IBM Spectrum Scale 5.0.4.1 through 5.1.0.3 could allow a local privileged user to overwrite files due to improper input validation. IBM X-Force ID: 192541. |
CVE-2021-29694 | High | 7.5 | 2021-04-26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2021-29672 | High | 7.8 | 2021-04-26 | IBM Spectrum Protect Client 8.1.0.0-8 through 1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking when processing the cur… |
CVE-2021-20546 | Medium | 5.5 | 2021-04-26 | IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could… |
CVE-2021-20536 | Medium | 6.2 | 2021-04-26 | IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-… |
CVE-2021-20532 | High | 7.8 | 2021-04-26 | IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 could allow a local user to escalate their privileges to take full control of the system due to insecure d… |
CVE-2021-20432 | Medium | 6.5 | 2021-04-26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and ret… |
CVE-2020-4562 | Medium | 5.3 | 2021-04-26 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by allowing cross-window communication with unrestricted target origin… |
CVE-2021-20501 | High | 8.2 | 2021-04-21 | IBM i 7.1, 7.2, 7.3, and 7.4 SMTP allows a network attacker to send emails to non-existent local-domain recipients to the SMTP server, caused by using a non-de… |
CVE-2021-20454 | High | 8.2 | 2021-04-21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attack… |
CVE-2021-20453 | High | 8.2 | 2021-04-20 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker co… |
CVE-2021-20527 | High | 7.2 | 2021-04-19 | IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759. |
CVE-2021-20491 | Medium | 4.4 | 2021-04-16 | IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of commands. By issui… |
CVE-2021-20519 | Medium | 5.4 | 2021-04-12 | IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2020-4965 | High | 7.5 | 2021-04-12 | IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-For… |
CVE-2020-4964 | Medium | 4.3 | 2021-04-12 | IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application wh… |
CVE-2020-4920 | Medium | 5.4 | 2021-04-12 | IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t… |
CVE-2021-29671 | Low | 3.3 | 2021-04-09 | IBM Spectrum Scale 5.1.0.1 could allow a local attacker to bypass the filesystem audit logging mechanism when file audit logging is enabled. IBM X-Force ID: 19… |
CVE-2021-20480 | Medium | 6.5 | 2021-04-08 | IBM WebSphere Application Server 7.0, 8.0, and 8.5 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authen… |
CVE-2020-4997 | Medium | 5.4 | 2021-04-05 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2020-4792 | Medium | 5.4 | 2021-04-05 | IBM Edge 4.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended… |
CVE-2021-20520 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20518 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20506 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20504 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20503 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20502 | High | 7.1 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vul… |
CVE-2021-20447 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20352 | Medium | 5.4 | 2021-03-30 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2021-20482 | High | 7.1 | 2021-03-30 | IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacke… |
CVE-2020-4944 | Medium | 5.5 | 2021-03-30 | IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore passwords in plain text after a manual e… |
CVE-2020-4884 | Medium | 5.5 | 2021-03-30 | IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1909… |
CVE-2020-4848 | Medium | 5.4 | 2021-03-30 | IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 could allow an authenticated user to initiate a plugin or compare process resources that they should n… |
CVE-2020-5015 | High | 7.5 | 2021-03-24 | IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a remote attacker to cause a denial of servic… |
CVE-2020-4882 | Medium | 6.1 | 2021-03-22 | IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from user-controlled data . This could enable… |
CVE-2020-4635 | Medium | 5.3 | 2021-03-19 | IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames. |
CVE-2020-4891 | Medium | 5.5 | 2021-03-16 | IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force R… |
CVE-2020-4890 | Medium | 4.4 | 2021-03-16 | IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a denial of service due… |
CVE-2020-4851 | Medium | 5.5 | 2021-03-16 | IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user to poison log files which could impact support and development effo… |
CVE-2021-20440 | Medium | 4.3 | 2021-03-15 | IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient. An attacker who is a valid user i… |
CVE-2020-4184 | High | 7.3 | 2021-03-15 | IBM Security Guardium 11.2 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies… |
CVE-2020-4831 | High | 7.5 | 2021-03-12 | IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2021-20336 | Medium | 5.4 | 2021-03-11 | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2020-5025 | High | 7.8 | 2021-03-11 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow, caused by improper… |
CVE-2020-5024 | High | 7.5 | 2021-03-11 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker to cause a denial of… |
CVE-2020-4976 | Medium | 4.4 | 2021-03-11 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and write specific files due… |
CVE-2020-5016 | Medium | 6.5 | 2021-03-10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When application security is disab… |
CVE-2020-4717 | Medium | 5.5 | 2021-03-10 | A vulnerability exists in IBM SPSS Modeler Subscription Installer that allows a user with create symbolic link permission to write arbitrary file in another pr… |
CVE-2021-20341 | Medium | 5.3 | 2021-03-09 | IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further attacks against the sys… |
CVE-2020-5014 | Medium | 6.7 | 2021-03-08 | IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side req… |
CVE-2020-4903 | Medium | 6.5 | 2021-03-08 | IBM API Connect V10 and V2018 could allow an attacker who has intercepted a registration invitation link to impersonate the registered user or obtain sensitive… |
CVE-2020-4695 | High | 7.5 | 2021-03-08 | IBM API Connect V10 is impacted by insecure communications during database replication. As the data replication happens over insecure communication channels, a… |
CVE-2021-20351 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2021-20350 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2021-20340 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2020-4975 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2020-4866 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2020-4863 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2020-4857 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2020-4856 | Medium | 5.4 | 2021-03-04 | IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2021-20442 | High | 7.5 | 2021-03-03 | IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2021-20441 | Medium | 5.9 | 2021-03-03 | IBM Security Verify Bridge uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2020-4726 | Low | 3.3 | 2021-03-02 | The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM… |
CVE-2020-4725 | Low | 3.5 | 2021-03-02 | IBM Monitoring (IBM Cloud APM 8.1.4 ) could allow an authenticated user to modify HTML content by sending a specially crafted HTTP request to the APM UI, which… |
CVE-2020-4719 | Medium | 4.9 | 2021-03-02 | The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. T… |
CVE-2020-4931 | Medium | 6.5 | 2021-02-24 | IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD AMQP Channels could allow an authenticated user to cause a denial of service due to an issue processing messages. IBM X-For… |
CVE-2020-4953 | Medium | 4.3 | 2021-02-23 | IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's internal structure by exposing sensitive i… |
CVE-2021-20446 | Medium | 5.4 | 2021-02-18 | IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2021-20445 | Medium | 6.5 | 2021-02-18 | IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Forc… |
CVE-2021-20444 | Medium | 6.1 | 2021-02-18 | IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2021-20443 | High | 8.8 | 2021-02-18 | IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is outside of the intended control sphere. I… |
CVE-2021-20354 | High | 7.5 | 2021-02-18 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL reques… |
CVE-2020-4933 | Medium | 5.4 | 2021-02-18 | IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2020-4956 | Medium | 4.8 | 2021-02-15 | IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped… |
CVE-2020-4955 | High | 8.0 | 2021-02-15 | IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system, caused by improper parameter validatio… |
CVE-2020-4954 | Medium | 5.4 | 2021-02-15 | IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation… |
CVE-2021-20412 | High | 7.5 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbou… |
CVE-2021-20411 | High | 8.1 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to impersonate another user on the system due to incorrectly updating the session iden… |
CVE-2021-20410 | Medium | 5.3 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user using man in the mi… |
CVE-2021-20409 | Medium | 5.9 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable H… |
CVE-2021-20408 | Medium | 5.5 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of a plaintext crypto… |
CVE-2021-20407 | Medium | 5.3 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 discloses sensitive information in source code that could be used in further attacks against the system… |
CVE-2021-20406 | Low | 2.2 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti… |
CVE-2021-20405 | High | 7.5 | 2021-02-11 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to perform unauthorized activities due to improper encoding of output. IBM X-Force ID… |
CVE-2021-20404 | Medium | 5.3 | 2021-02-11 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user on the network to cause a denial of service due to an invalid cookie value that could… |