IBM
Page 35 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-4689 | High | 7.5 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTT… |
CVE-2019-4688 | Medium | 4.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get… |
CVE-2019-4686 | Medium | 5.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get… |
CVE-2018-1501 | High | 7.5 | 2020-08-26 | IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to missing security controls. IBM X-Force ID: 1… |
CVE-2020-4598 | Medium | 6.1 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit… |
CVE-2020-4593 | Medium | 4.4 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184747. |
CVE-2020-4587 | High | 7.8 | 2020-08-24 | IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, 6.0.0, and 6.1.0 is vulnerable to a stack based buffer ovreflow, caused by improper bounds checking. A local… |
CVE-2020-4383 | Medium | 6.5 | 2020-08-24 | IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment while co… |
CVE-2020-4382 | Medium | 5.5 | 2020-08-24 | IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment or upgra… |
CVE-2020-4170 | Medium | 4.3 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tr… |
CVE-2020-4165 | Medium | 5.4 | 2020-08-24 | IBM Security Guardium Insights 2.0.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web… |
CVE-2018-1985 | Medium | 4.4 | 2020-08-24 | IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator privileges to cause a buffer overflow that w… |
CVE-2020-4687 | Medium | 4.3 | 2020-08-20 | IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force… |
CVE-2020-4548 | Low | 2.7 | 2020-08-20 | IBM Content Navigator 3.0.7 and 3.0.8 is vulnerable to improper input validation. A malicious administrator could bypass the user interface and send requests t… |
CVE-2020-4653 | Medium | 6.1 | 2020-08-19 | IBM Planning Analytics 2.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a speciall… |
CVE-2020-4648 | Medium | 6.5 | 2020-08-19 | A vulnerability exsists in IBM Planning Analytics 2.0 whereby avatars in Planning Analytics Workspace could be modified by other users without authorization to… |
CVE-2020-4381 | Medium | 6.5 | 2020-08-19 | IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgra… |
CVE-2020-4686 | High | 8.1 | 2020-08-17 | IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to… |
CVE-2020-4662 | High | 8.8 | 2020-08-14 | IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication validation. IBM X-Force ID: 186233. |
CVE-2020-4589 | Critical | 9.8 | 2020-08-13 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence… |
CVE-2019-4582 | Medium | 4.3 | 2020-08-13 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL… |
CVE-2020-4486 | High | 8.1 | 2020-08-11 | IBM QRadar 7.2.0 thorugh 7.2.9 could allow an authenticated user to overwrite or delete arbitrary files due to a flaw after WinCollect installation. IBM X-Forc… |
CVE-2020-4485 | Medium | 6.5 | 2020-08-11 | IBM QRadar 7.2.0 through 7.2.9 could allow an authenticated user to disable the Wincollect service which could aid an attacker in bypassing security mechanisms… |
CVE-2020-4541 | Medium | 6.1 | 2020-08-10 | IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2020-4539 | Medium | 6.1 | 2020-08-10 | IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java… |
CVE-2020-4533 | Medium | 6.1 | 2020-08-10 | IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4481 | High | 8.2 | 2020-08-05 | IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A re… |
CVE-2020-4243 | Low | 3.7 | 2020-08-05 | IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle… |
CVE-2020-4631 | Medium | 5.5 | 2020-08-04 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permis… |
CVE-2020-4542 | Medium | 5.4 | 2020-08-04 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4525 | Medium | 5.4 | 2020-08-04 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4459 | Critical | 9.8 | 2020-08-04 | IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, out… |
CVE-2020-4410 | Medium | 4.3 | 2020-08-04 | IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to send a specially crafted HTTP GET request to read attachments on the serv… |
CVE-2020-4396 | Medium | 5.4 | 2020-08-04 | IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4560 | Medium | 6.1 | 2020-08-03 | IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2020-4554 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4553 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4552 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to op… |
CVE-2020-4551 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4550 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a vi… |
CVE-2020-4549 | High | 7.8 | 2020-08-03 | IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to op… |
CVE-2020-4534 | High | 8.8 | 2020-08-03 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by imprope… |
CVE-2020-4377 | Critical | 9.1 | 2020-08-03 | IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this… |
CVE-2020-4328 | Medium | 6.3 | 2020-08-03 | IBM Financial Transaction Manager 3.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the at… |
CVE-2019-4589 | Medium | 4.3 | 2020-08-03 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and accessible to a less pri… |
CVE-2019-4366 | Medium | 5.3 | 2020-08-03 | IBM Cognos Analytics 11.0 and 11.1 is susceptible to an information disclosure vulnerability where an attacker could gain access to cached browser data. IBM X-… |
CVE-2020-4186 | Medium | 5.3 | 2020-07-30 | IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-F… |
CVE-2020-4185 | High | 7.5 | 2020-07-30 | IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |
CVE-2020-4645 | Medium | 5.4 | 2020-07-29 | IBM Planning Analytics Local 2.0.0 through 2.0.9.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2020-4644 | Medium | 5.4 | 2020-07-29 | IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a… |
CVE-2020-4574 | High | 7.5 | 2020-07-29 | IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user ac… |
CVE-2020-4573 | Medium | 5.3 | 2020-07-29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests. IBM X-Force ID: 184180. |
CVE-2020-4572 | Medium | 5.3 | 2020-07-29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returne… |
CVE-2020-4569 | Medium | 6.5 | 2020-07-29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by… |
CVE-2020-4567 | Critical | 9.8 | 2020-07-29 | IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials… |
CVE-2020-4463 | High | 8.2 | 2020-07-29 | IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker coul… |
CVE-2020-4465 | Medium | 6.5 | 2020-07-28 | IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS is vulnerable to a buffer overflow vulnerability due to an error within the chann… |
CVE-2020-4375 | High | 7.5 | 2020-07-28 | IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS could allow an attacker to cause a denial of service due to a memory leak caused by a… |
CVE-2020-4319 | Medium | 4.3 | 2020-07-28 | IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitiv… |
CVE-2020-4318 | Medium | 5.4 | 2020-07-28 | IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cro… |
CVE-2020-4317 | Medium | 5.4 | 2020-07-28 | IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cro… |
CVE-2019-4731 | Medium | 5.5 | 2020-07-28 | IBM MQ Appliance 9.1.4.CD could allow a local attacker to obtain highly sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 1726… |
CVE-2020-4498 | Medium | 4.4 | 2020-07-27 | IBM MQ Appliance 9.1 LTS and 9.1 CD could allow a local privileged user to obtain highly sensitve information due to inclusion of data within trace files. IBM… |
CVE-2020-4408 | Medium | 4.6 | 2020-07-27 | The IBM QRadar Advisor 1.1 through 2.5.2 with Watson App for IBM QRadar SIEM does not adequately mask all passwords during input, which could be obtained by a… |
CVE-2020-4405 | Medium | 4.3 | 2020-07-27 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log files. IBM X-Force… |
CVE-2020-4447 | Medium | 5.4 | 2020-07-23 | IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2020-4400 | High | 7.5 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM… |
CVE-2020-4399 | Medium | 6.5 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial of service against the server. IBM X-Fo… |
CVE-2020-4397 | Medium | 5.9 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in the middle technique… |
CVE-2020-4385 | Critical | 9.8 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentica… |
CVE-2020-4372 | High | 7.8 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009 |
CVE-2020-4371 | Low | 3.3 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against t… |
CVE-2020-4369 | Medium | 5.5 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. IBM X-Force ID: 179004. |
CVE-2020-4125 | High | 8.1 | 2020-07-20 | Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the… |
CVE-2020-4527 | Medium | 5.9 | 2020-07-20 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for the session cookie i… |
CVE-2020-4466 | Medium | 6.5 | 2020-07-20 | IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due to an error within the Queue processing… |
CVE-2020-4361 | Medium | 4.3 | 2020-07-20 | IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. IBM X-Force ID… |
CVE-2020-4464 | High | 8.8 | 2020-07-17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafte… |
CVE-2020-4462 | High | 8.2 | 2020-07-16 | IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an… |
CVE-2020-4316 | Medium | 4.7 | 2020-07-16 | IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the co… |
CVE-2019-4748 | Medium | 5.4 | 2020-07-16 | IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2019-4747 | Medium | 5.4 | 2020-07-16 | IBM Team Concert (RTC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2020-4513 | Medium | 6.1 | 2020-07-14 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2020-4512 | High | 7.2 | 2020-07-14 | IBM QRadar SIEM 7.3 and 7.4 could allow a remote privileged user to execute commands. |
CVE-2020-4511 | Medium | 6.5 | 2020-07-14 | IBM QRadar SIEM 7.3 and 7.4 could allow an authenticated user to cause a denial of service of the qflow process by sending a malformed sflow command. IBM X-For… |
CVE-2020-4510 | Medium | 5.5 | 2020-07-14 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulne… |
CVE-2020-4364 | Medium | 5.4 | 2020-07-14 | IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2019-4591 | High | 7.8 | 2020-07-13 | IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system… |
CVE-2020-4305 | High | 8.8 | 2020-07-09 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of… |
CVE-2020-4173 | Medium | 4.3 | 2020-07-09 | IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the coo… |
CVE-2020-4420 | High | 7.5 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker to cause a denial of… |
CVE-2020-4414 | Medium | 4.4 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local attacker to perform unauthorized actions… |
CVE-2020-4387 | Medium | 4.7 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information usin… |
CVE-2020-4386 | Medium | 4.7 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information usin… |
CVE-2020-4376 | Medium | 6.5 | 2020-07-01 | IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow an attacker to cause a denial of service caused by an error within the pubsub logi… |
CVE-2020-4363 | High | 7.8 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds… |
CVE-2020-4355 | Medium | 5.3 | 2020-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service, caused by improper hand… |
CVE-2019-4706 | Low | 2.7 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable guidance to an attac… |
CVE-2019-4705 | Low | 2.7 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attac… |
CVE-2019-4704 | Medium | 4.3 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to ge… |