IBM
Page 32 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20403 | High | 8.8 | 2021-02-11 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauth… |
CVE-2021-20402 | Low | 2.7 | 2021-02-11 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2020-4768 | Medium | 5.4 | 2021-02-11 | IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allows users… |
CVE-2021-20353 | High | 8.2 | 2021-02-10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2020-5023 | High | 7.5 | 2021-02-10 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash due to excess resour… |
CVE-2020-4996 | Medium | 5.5 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a local user to obtain sensitive information via the capturing of screenshots of authentica… |
CVE-2020-4995 | Medium | 5.3 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from… |
CVE-2020-4795 | High | 8.2 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information to an unauthorized user using a specially crafted HTTP request. IB… |
CVE-2020-4791 | Medium | 5.3 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to obtain sensitive information using main in the middle attacks due to imprope… |
CVE-2020-4790 | Medium | 6.5 | 2021-02-09 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a user to cause a denial of service due to improperly validating a supplied URL, rendering… |
CVE-2021-20359 | Medium | 6.5 | 2021-02-08 | IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentially sensitive information in log files th… |
CVE-2021-20358 | Medium | 6.5 | 2021-02-08 | IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. This information could be… |
CVE-2020-4832 | Medium | 5.5 | 2021-02-05 | IBM PowerHA 7.2 could allow a local attacker to obtain sensitive information from temporary directories after a discovery failure occurs. IBM X-Force ID: 18996… |
CVE-2020-5032 | Medium | 4.3 | 2021-02-04 | IBM QRadar SIEM 7.3 and 7.4 in some configurations may be vulnerable to a temporary denial of service attack when sent particular payloads. IBM X-Force ID: 194… |
CVE-2020-4828 | Medium | 6.5 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to web cache poisoning, caused by improper input validation by modif… |
CVE-2020-4827 | Medium | 4.3 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execu… |
CVE-2020-4826 | Medium | 4.3 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execu… |
CVE-2020-4825 | Medium | 5.4 | 2021-02-04 | IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar… |
CVE-2020-4640 | Medium | 4.1 | 2021-02-04 | Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment ide… |
CVE-2020-4934 | Medium | 4.3 | 2021-02-02 | IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request contai… |
CVE-2020-4888 | High | 8.8 | 2021-01-28 | IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure… |
CVE-2020-4682 | Critical | 9.8 | 2021-01-28 | IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of tr… |
CVE-2021-20357 | Medium | 5.4 | 2021-01-27 | IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2020-4952 | High | 8.8 | 2021-01-27 | IBM Security Guardium 11.2 could allow an authenticated user to gain root access due to improper access control. IBM X-Force ID: 192028. |
CVE-2020-4865 | Medium | 5.4 | 2021-01-27 | IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2020-4855 | Medium | 5.4 | 2021-01-27 | IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2020-4789 | Medium | 6.5 | 2021-01-27 | IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 could allow a remote attacker to traverse directories on the syst… |
CVE-2020-4787 | Low | 2.3 | 2021-01-27 | IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery (SSRF). This may all… |
CVE-2020-4786 | Medium | 4.3 | 2021-01-27 | IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery (SSRF). This may all… |
CVE-2020-4547 | Medium | 5.4 | 2021-01-27 | IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a… |
CVE-2020-4524 | Medium | 5.4 | 2021-01-27 | IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2020-4189 | Medium | 4.3 | 2021-01-27 | IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attacks against the system. IBM X-Force ID: 17… |
CVE-2020-4967 | Medium | 4.3 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks against the system… |
CVE-2020-4820 | Medium | 6.1 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2020-4816 | Medium | 5.9 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict T… |
CVE-2020-4815 | Medium | 5.3 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further at… |
CVE-2020-4628 | Medium | 5.3 | 2021-01-27 | IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2020-27583 | Critical | 9.8 | 2021-01-26 | IBM InfoSphere Information Server 8.5.0.0 is affected by deserialization of untrusted data which could allow remote unauthenticated attackers to execute arbitr… |
CVE-2020-4949 | High | 8.2 | 2021-01-26 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2020-4889 | Low | 3.3 | 2021-01-26 | IBM Spectrum Scale 5.0.0 through 5.0.5.4 and 5.1.0 could allow a local user to poison log files which could impact support and development efforts. IBM X-Force… |
CVE-2020-4766 | High | 7.5 | 2021-01-22 | IBM MQ Internet Pass-Thru 2.1 and 9.2 could allow a remote user to cause a denial of service by sending malformed MQ data requests which would consume all avai… |
CVE-2020-4969 | Medium | 5.9 | 2021-01-21 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable… |
CVE-2020-4968 | Medium | 6.5 | 2021-01-21 | IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensi… |
CVE-2020-4966 | Medium | 4.3 | 2021-01-21 | IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to… |
CVE-2020-4958 | Critical | 9.8 | 2021-01-21 | IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consume… |
CVE-2020-4983 | High | 7.8 | 2021-01-20 | IBM Spectrum LSF 10.1 and IBM Spectrum LSF Suite 10.2 could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary comman… |
CVE-2020-4921 | High | 8.8 | 2021-01-20 | IBM Security Guardium 10.6 and 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attack… |
CVE-2020-4887 | Medium | 5.5 | 2021-01-20 | IBM AIX 7.1, 7.2 and AIX VIOS 3.1 could allow a local user to exploit a vulnerability in the gencore user command to create arbitrary files in any directory. I… |
CVE-2020-4688 | High | 7.8 | 2021-01-20 | IBM Security Guardium 10.6 and 11.2 could allow a local attacker to execute arbitrary commands on the system as an unprivileged user, caused by command injecti… |
CVE-2020-4881 | High | 7.5 | 2021-01-19 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server hostname verification for SSL/TLS commun… |
CVE-2020-4873 | Medium | 5.3 | 2021-01-19 | IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 190836. |
CVE-2020-4871 | Medium | 5.5 | 2021-01-19 | IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 190834. |
CVE-2020-4604 | Medium | 4.4 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID: 184861. |
CVE-2020-4602 | Medium | 4.4 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184836. |
CVE-2020-4600 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2020-4599 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2020-4597 | Medium | 4.3 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie valu… |
CVE-2020-4596 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4595 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4594 | High | 7.5 | 2021-01-13 | IBM Security Guardium Insights 2.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2019-4702 | High | 8.1 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or mod… |
CVE-2019-4687 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized par… |
CVE-2019-4160 | High | 7.5 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2020-4838 | Medium | 5.4 | 2021-01-12 | IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2020-4674 | Medium | 4.3 | 2021-01-12 | IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-Force ID: 186287. |
CVE-2020-4673 | Medium | 4.3 | 2021-01-12 | IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286. |
CVE-2020-4869 | Medium | 6.5 | 2021-01-11 | IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial of service, caused by a buffer overflow. A remote attacker could send a specially crafted SNMP qu… |
CVE-2020-4733 | Medium | 5.4 | 2021-01-08 | IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2020-4697 | Medium | 5.4 | 2021-01-08 | IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2020-4691 | Medium | 5.4 | 2021-01-08 | IBM Jazz Foundation Products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2020-4544 | Medium | 4.3 | 2021-01-08 | IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2020-4487 | Medium | 4.3 | 2021-01-08 | IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser… |
CVE-2020-5022 | Medium | 5.3 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining infor… |
CVE-2020-5021 | Medium | 4.4 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user o… |
CVE-2020-5020 | Medium | 6.1 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a ma… |
CVE-2020-5019 | Medium | 6.5 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending… |
CVE-2020-5018 | High | 7.5 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being caputured by an att… |
CVE-2020-5017 | Medium | 5.5 | 2021-01-08 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions. IBM X-Force… |
CVE-2020-4667 | Medium | 4.3 | 2021-01-08 | IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improper input validation… |
CVE-2020-4666 | Medium | 5.4 | 2021-01-08 | IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2020-4664 | Medium | 5.4 | 2021-01-08 | IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2020-4663 | Medium | 5.4 | 2021-01-08 | IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2020-4606 | Medium | 4.4 | 2021-01-08 | IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A local attacker could expl… |
CVE-2020-4898 | High | 7.5 | 2021-01-07 | IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2020-4897 | Medium | 5.3 | 2021-01-07 | IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when… |
CVE-2020-4896 | Medium | 6.5 | 2021-01-07 | IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. I… |
CVE-2020-4895 | Medium | 5.4 | 2021-01-07 | IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbi… |
CVE-2020-4893 | Medium | 5.9 | 2021-01-07 | IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to informatio… |
CVE-2020-4892 | Medium | 5.4 | 2021-01-07 | IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2020-4336 | Medium | 5.3 | 2021-01-06 | IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access t… |
CVE-2020-4899 | Critical | 9.1 | 2021-01-05 | IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due to plain text transmission of sensitive… |
CVE-2020-4762 | High | 8.8 | 2021-01-05 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated user to create a priv… |
CVE-2020-4761 | Medium | 5.3 | 2021-01-05 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive… |
CVE-2019-4728 | High | 8.8 | 2021-01-05 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to execute arbitrary… |
CVE-2020-4942 | High | 8.8 | 2021-01-04 | IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unautho… |
CVE-2020-4928 | Medium | 6.7 | 2021-01-04 | IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention, the a… |
CVE-2020-4919 | Low | 3.8 | 2021-01-04 | IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-F… |
CVE-2020-4918 | Medium | 4.4 | 2021-01-04 | IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference in sell service conso… |
CVE-2020-4917 | High | 8.8 | 2021-01-04 | IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted fr… |
CVE-2020-4916 | Medium | 4.8 | 2021-01-04 | IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |