IBM
Page 34 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4679 | Medium | 4.8 | 2020-10-12 | IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2020-4678 | Medium | 4.9 | 2020-10-12 | IBM Security Guardium 11.2 could allow an attacker with admin access to obtain and read files that they normally would not have access to. IBM X-Force ID: 1864… |
CVE-2020-4388 | High | 8.2 | 2020-10-12 | IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a servlet also exposing debug informatio… |
CVE-2020-4302 | High | 7.8 | 2020-10-12 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to… |
CVE-2020-4781 | Medium | 6.5 | 2020-10-12 | An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could result in a den… |
CVE-2020-4780 | Medium | 5.3 | 2020-10-12 | OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of th… |
CVE-2020-4779 | High | 8.1 | 2020-10-12 | A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a specially-crafted request, an attacker could… |
CVE-2020-4778 | High | 7.5 | 2020-10-12 | IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptograph… |
CVE-2020-4776 | High | 7.5 | 2020-10-12 | A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remote attacker to traverse directories on… |
CVE-2020-4775 | Medium | 5.4 | 2020-10-12 | A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malic… |
CVE-2020-4774 | Medium | 5.4 | 2020-10-12 | An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a sp… |
CVE-2020-4773 | Medium | 6.5 | 2020-10-12 | A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to exe… |
CVE-2020-4772 | High | 8.1 | 2020-10-12 | An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vuln… |
CVE-2020-4699 | Medium | 5.3 | 2020-10-12 | IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which cou… |
CVE-2020-4661 | Medium | 5.3 | 2020-10-12 | IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which cou… |
CVE-2020-4660 | Medium | 5.3 | 2020-10-12 | IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which cou… |
CVE-2020-4799 | High | 7.8 | 2020-10-08 | IBM Informix spatial 14.10 could allow a local user to execute commands as a privileged user due to an out of bounds write vulnerability. IBM X-Force ID: 18946… |
CVE-2020-4280 | High | 8.8 | 2020-10-08 | IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied cont… |
CVE-2019-4545 | High | 7.5 | 2020-10-08 | IBM QRadar SIEM 7.3 and 7.4 when configured to use Active Directory Authentication may be susceptible to spoofing attacks. IBM X-Force ID: 165877. |
CVE-2020-4528 | Medium | 5.5 | 2020-10-06 | IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under special conditions, to obtain highly sensi… |
CVE-2019-4725 | Medium | 6.1 | 2020-10-06 | IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2020-4493 | Critical | 9.8 | 2020-10-05 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow an attacker to bypass authentication and issue commands using a specially crafted HTTP command. IBM X-F… |
CVE-2020-4576 | High | 7.5 | 2020-10-01 | IBM WebSphere Application Server 7.5, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequ… |
CVE-2020-4629 | Low | 3.3 | 2020-09-30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed techni… |
CVE-2020-4607 | High | 7.8 | 2020-09-29 | IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to improper input val… |
CVE-2020-4727 | Medium | 6.1 | 2020-09-25 | IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious W… |
CVE-2020-4531 | Medium | 5.3 | 2020-09-25 | IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive info… |
CVE-2020-4340 | Medium | 4.3 | 2020-09-23 | IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180. |
CVE-2020-4324 | Medium | 4.3 | 2020-09-23 | IBM Security Secret Server proir to 10.9 could allow a remote attacker to bypass security restrictions, caused by improper input validation. IBM X-Force ID: 17… |
CVE-2020-4622 | High | 7.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2020-4621 | High | 8.8 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient authorization checks. IB… |
CVE-2020-4620 | High | 8.8 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions… |
CVE-2020-4619 | Medium | 6.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 184976. |
CVE-2020-4618 | Medium | 4.9 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation. IBM X-Force ID: 184937. |
CVE-2020-4617 | High | 8.1 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tran… |
CVE-2020-4616 | Medium | 5.3 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 184929. |
CVE-2020-4615 | Medium | 5.4 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2020-4614 | High | 7.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Forc… |
CVE-2020-4613 | High | 7.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM… |
CVE-2020-4612 | Medium | 6.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to obtain sensitive information using a specially crafted HTTP request. IBM X-Force ID: 18… |
CVE-2020-4611 | High | 8.8 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to bypass security and execute actions reserved for admins. IBM X-Force ID: 184922. |
CVE-2020-4643 | High | 7.5 | 2020-09-21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2020-4731 | Medium | 6.1 | 2020-09-21 | IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t… |
CVE-2020-4590 | Medium | 6.5 | 2020-09-21 | IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to a denial of se… |
CVE-2020-4581 | High | 7.5 | 2020-09-21 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a chunked transfer-encoding HTTP/2 r… |
CVE-2020-4580 | High | 7.5 | 2020-09-21 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request w… |
CVE-2020-4579 | High | 7.5 | 2020-09-21 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request w… |
CVE-2020-4315 | Medium | 4.3 | 2020-09-21 | IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to ge… |
CVE-2020-4708 | Medium | 5.3 | 2020-09-16 | IBM Security Trusteer Pinpoint Detect 11.6.5 could disclose some information due to using a wildcard in the Access-Control-Allow-Origin header. IBM X-Force ID… |
CVE-2020-4409 | High | 8.2 | 2020-09-16 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to vis… |
CVE-2020-8340 | Medium | 6.3 | 2020-09-15 | A cross-site scripting (XSS) vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 (Integrated Management Module 2), prior to version 5.60, e… |
CVE-2020-8339 | Medium | 4.3 | 2020-09-15 | A cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module (AMM) web interface prior to versio… |
CVE-2020-4711 | Medium | 6.5 | 2020-09-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted… |
CVE-2020-4703 | High | 8.0 | 2020-09-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute a… |
CVE-2020-4530 | Medium | 5.4 | 2020-09-15 | IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows use… |
CVE-2020-4526 | Medium | 4.3 | 2020-09-15 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized act… |
CVE-2020-4521 | High | 8.8 | 2020-09-15 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserializ… |
CVE-2020-4344 | Low | 3.3 | 2020-09-15 | IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force I… |
CVE-2019-4671 | Medium | 6.3 | 2020-09-15 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow th… |
CVE-2020-4578 | Medium | 5.4 | 2020-09-10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2020-4698 | Medium | 5.4 | 2020-09-08 | IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to stored cross-site scripting. This vulnerabili… |
CVE-2020-4516 | Medium | 5.4 | 2020-09-08 | IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2020-4702 | Medium | 5.4 | 2020-09-04 | IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2020-4632 | Medium | 6.5 | 2020-09-04 | IBM InfoSphere Metadata Asset Manager 11.7 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacke… |
CVE-2020-4545 | High | 7.8 | 2020-09-04 | IBM Aspera Connect 3.9.9 could allow a remote attacker to execute arbitrary code on the system, caused by improper loading of Dynamic Link Libraries by the imp… |
CVE-2020-4638 | High | 7.2 | 2020-09-03 | IBM API Connect's API Manager 2018.4.1.0 through 2018.4.1.12 is vulnerable to privilege escalation. An invitee to an API Provider organization can escalate pri… |
CVE-2020-4337 | Medium | 6.5 | 2020-09-03 | IBM API Connect 2018.4.1.0 through 2018.4.1.12 could allow an attacker to launch phishing attacks by tricking the server to generate user registration emails t… |
CVE-2020-4693 | Critical | 9.8 | 2020-09-02 | IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to execute arbitrary code on the system, caus… |
CVE-2020-4546 | Medium | 5.4 | 2020-09-02 | IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2020-4522 | Medium | 5.4 | 2020-09-02 | IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2020-4445 | Medium | 5.4 | 2020-09-02 | IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2012-3341 | Medium | 5.4 | 2020-09-01 | IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker… |
CVE-2012-3340 | Medium | 4.3 | 2020-09-01 | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validation of user-supplied input. A remote authe… |
CVE-2012-3338 | Medium | 5.3 | 2020-09-01 | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions on the create new use… |
CVE-2012-3337 | Medium | 5.3 | 2020-09-01 | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL… |
CVE-2012-3336 | High | 8.8 | 2020-09-01 | IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to multi… |
CVE-2020-4492 | Medium | 5.5 | 2020-08-31 | IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashing the kernel by se… |
CVE-2020-4591 | Low | 3.3 | 2020-08-28 | IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the sec… |
CVE-2020-4559 | High | 7.5 | 2020-08-28 | IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM X-Force ID: 183613. |
CVE-2019-4579 | Medium | 4.3 | 2020-08-28 | IBM Resilient SOAR 38 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the… |
CVE-2019-4533 | Medium | 4.3 | 2020-08-28 | IBM Resilient SOAR V38.0 users may experience a denial of service of the SOAR Platform due to a insufficient input validation. IBM X-Force ID: 165589. |
CVE-2020-4603 | High | 7.2 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or… |
CVE-2020-4575 | Medium | 6.1 | 2020-08-27 | IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability… |
CVE-2020-4175 | Medium | 5.9 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transp… |
CVE-2020-4174 | High | 7.5 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4172 | Medium | 5.3 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have acces… |
CVE-2020-4171 | Medium | 4.3 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174407. |
CVE-2020-4169 | High | 7.5 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. I… |
CVE-2020-4167 | Medium | 6.5 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized actions due to improper authenciation mech… |
CVE-2020-4166 | Medium | 5.3 | 2020-08-27 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2019-4695 | Low | 3.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 1719… |
CVE-2019-4713 | High | 8.8 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a speci… |
CVE-2019-4701 | Medium | 5.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 171936. |
CVE-2019-4699 | Low | 2.7 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated… |
CVE-2019-4698 | High | 7.5 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to… |
CVE-2019-4697 | Medium | 6.5 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID… |
CVE-2019-4694 | Critical | 9.8 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound… |
CVE-2019-4693 | Medium | 4.4 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID… |
CVE-2019-4692 | Medium | 5.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks… |
CVE-2019-4691 | Medium | 5.4 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |