IBM
Page 38 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4283 | High | 8.6 | 2020-03-02 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains hard-coded credentials, such as a password or cryptographic key, which it… |
CVE-2019-4669 | Medium | 6.3 | 2020-02-27 | IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3… |
CVE-2019-4726 | Medium | 4.3 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malic… |
CVE-2019-4598 | Medium | 6.3 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL stateme… |
CVE-2019-4597 | Medium | 6.3 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL stateme… |
CVE-2019-4596 | Medium | 5.4 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |
CVE-2019-4537 | Medium | 5.3 | 2020-02-26 | IBM WebSphere Service Registry and Repository 8.5 could allow a user to obtain sensitive version information that could be used in further attacks against the… |
CVE-2019-4672 | Medium | 5.3 | 2020-02-25 | IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in… |
CVE-2019-4557 | High | 7.5 | 2020-02-25 | IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info… |
CVE-2020-4222 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4213 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4212 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4211 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2020-4210 | Critical | 9.8 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, a… |
CVE-2019-4745 | Medium | 4.3 | 2020-02-24 | IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information… |
CVE-2019-4703 | Medium | 5.3 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system… |
CVE-2019-4595 | Medium | 6.1 | 2020-02-24 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack… |
CVE-2012-6277 | High | 7.8 | 2020-02-21 | Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Symantec Mai… |
CVE-2019-4752 | High | 8.8 | 2020-02-20 | IBM Emptoris Spend Analysis and IBM Emptoris Strategic Supply Management Platform 10.1.0.x, 10.1.1.x, and 10.1.3.x is vulnerable to SQL injection. A remote att… |
CVE-2019-4583 | Medium | 4.3 | 2020-02-20 | IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid… |
CVE-2020-4230 | Medium | 6.7 | 2020-02-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 and 11.5 is vulnerable to an escalation of privilege when an authenticated local attacke… |
CVE-2020-4204 | High | 7.8 | 2020-02-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds… |
CVE-2020-4200 | Medium | 6.5 | 2020-02-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated attacker to send specially crafted commands… |
CVE-2020-4161 | Medium | 6.5 | 2020-02-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service due to incorrect hand… |
CVE-2020-4135 | High | 7.5 | 2020-02-19 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to send specially crafted… |
CVE-2019-4640 | Critical | 9.8 | 2020-02-19 | IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which co… |
CVE-2019-4457 | Medium | 6.5 | 2020-02-19 | IBM Jazz Foundation 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 could allow an authenticated user to obtain sensitive information that could be… |
CVE-2019-4429 | Medium | 5.4 | 2020-02-19 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2012-0718 | Medium | 5.4 | 2020-02-18 | IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies. |
CVE-2013-3323 | Critical | 9.8 | 2020-02-18 | A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a failure… |
CVE-2019-4666 | Low | 2.3 | 2020-02-13 | IBM UrbanCode Deploy (UCD) 7.0.3 and IBM UrbanCode Build 6.1.5 could allow a local user to obtain sensitive information by unmasking certain secure values in d… |
CVE-2019-4592 | High | 7.5 | 2020-02-13 | IBM Tivoli Monitoring Service 6.3.0.7.3 through 6.3.0.7.10 could allow an unauthorized user to access and modify operation aspects of the ITM monitoring server… |
CVE-2019-4741 | Medium | 5.3 | 2020-02-12 | IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from… |
CVE-2019-4431 | Medium | 5.4 | 2020-02-12 | IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2019-4427 | High | 7.5 | 2020-02-12 | IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a… |
CVE-2013-0517 | High | 7.8 | 2020-02-11 | A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which co… |
CVE-2012-2204 | Medium | 5.5 | 2020-02-10 | InfoSphere Guardium aix_ktap module: DoS |
CVE-2015-0102 | High | 8.1 | 2020-02-05 | IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this co… |
CVE-2019-4670 | Medium | 6.5 | 2020-02-05 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper data representation. I… |
CVE-2019-4616 | Low | 3.5 | 2020-02-05 | IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie valu… |
CVE-2019-4613 | High | 8.8 | 2020-02-05 | IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2013-0507 | High | 8.1 | 2020-02-05 | IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability |
CVE-2020-4163 | High | 7.2 | 2020-02-04 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file n… |
CVE-2019-4675 | Critical | 9.8 | 2020-02-04 | IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2019-4674 | Medium | 4.9 | 2020-02-04 | IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request… |
CVE-2019-4562 | Medium | 5.3 | 2020-02-04 | IBM Security Directory Server 6.4.0 stores sensitive information in URLs. This may lead to information disclosure if unauthorized parties have access to the UR… |
CVE-2019-4551 | Medium | 5.3 | 2020-02-04 | IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protec… |
CVE-2019-4550 | Medium | 5.3 | 2020-02-04 | IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 165952. |
CVE-2019-4548 | Medium | 6.1 | 2020-02-04 | IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web… |
CVE-2019-4541 | High | 7.2 | 2020-02-04 | IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct… |
CVE-2019-4540 | High | 7.5 | 2020-02-04 | IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IB… |
CVE-2019-4451 | Medium | 5.4 | 2020-02-04 | IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2020-4224 | Medium | 5.5 | 2020-02-03 | IBM StoredIQ 7.6.0.17 through 7.6.0.20 could disclose sensitive information to a local user due to data in certain directories not being encrypted when it cont… |
CVE-2019-4732 | Medium | 6.5 | 2020-02-03 | IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated att… |
CVE-2019-4720 | High | 7.5 | 2020-01-31 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker… |
CVE-2020-4207 | Critical | 9.8 | 2020-01-28 | IBM Watson IoT Message Gateway 2.0.0.x, 5.0.0.0, 5.0.0.1, and 5.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking when handling a fa… |
CVE-2019-4707 | High | 7.1 | 2020-01-28 | IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could… |
CVE-2019-4679 | Medium | 4.3 | 2020-01-28 | IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could be used in further… |
CVE-2019-4639 | High | 7.5 | 2020-01-28 | IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-… |
CVE-2019-4638 | Low | 3.7 | 2020-01-28 | IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive… |
CVE-2019-4637 | Medium | 4.3 | 2020-01-28 | IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct imp… |
CVE-2019-4636 | Low | 2.7 | 2020-01-28 | IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013. |
CVE-2019-4635 | Low | 2.7 | 2020-01-28 | IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporoper input neutralization of special elemen… |
CVE-2019-4633 | Medium | 4.3 | 2020-01-28 | IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 170007. |
CVE-2019-4632 | Medium | 6.1 | 2020-01-28 | IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2019-4631 | Medium | 6.1 | 2020-01-28 | IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a spe… |
CVE-2019-4620 | High | 7.8 | 2020-01-28 | IBM MQ Appliance 8.0 and 9.0 LTS could allow a local attacker to bypass security restrictions caused by improper validation of environment variables. IBM X-For… |
CVE-2019-4614 | Medium | 6.5 | 2020-01-28 | IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS client connecting to a Queue Manager could cause a SIGSEGV denial of service caused by converting an invalid messag… |
CVE-2019-4568 | Medium | 5.9 | 2020-01-28 | IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS could allow a remote attacker with intimate knowledge of the server to cause a denial of service when receiving dat… |
CVE-2012-4863 | Medium | 6.5 | 2020-01-23 | IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability |
CVE-2020-7239 | Medium | 6.1 | 2020-01-21 | The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent. |
CVE-2019-4559 | Medium | 5.3 | 2020-01-10 | IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system… |
CVE-2019-4508 | High | 7.8 | 2020-01-10 | IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local attacker. IBM X-Force ID: 164429. |
CVE-2019-4651 | Critical | 9.8 | 2020-01-09 | IBM Jazz Reporting Service (JRS) 6.0.6.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the a… |
CVE-2019-4655 | Medium | 4.3 | 2019-12-30 | IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticated user to reset… |
CVE-2019-4623 | Medium | 5.4 | 2019-12-30 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2019-4343 | Medium | 6.5 | 2019-12-30 | IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private information. An att… |
CVE-2019-4335 | Medium | 5.5 | 2019-12-30 | IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user. IBM X-Force ID: 161413. |
CVE-2018-1682 | Medium | 5.3 | 2019-12-30 | IBM Watson Studio Local 1.2.3 could disclose sensitive information over the network that an attacked could use in further attacks against the system. IBM X-For… |
CVE-2019-4744 | Medium | 6.1 | 2019-12-20 | IBM Financial Transaction Manager 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t… |
CVE-2019-4743 | Medium | 4.3 | 2019-12-20 | IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie val… |
CVE-2019-4742 | Medium | 6.1 | 2019-12-20 | IBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious We… |
CVE-2019-4736 | Medium | 4.3 | 2019-12-20 | IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions t… |
CVE-2019-4555 | Medium | 5.4 | 2019-12-20 | IBM Cognos Analytics 11.0 and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2019-4231 | Medium | 4.3 | 2019-12-20 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tran… |
CVE-2018-1934 | High | 8.8 | 2019-12-20 | IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2019-4716 | Critical | 9.8 | 2019-12-18 | IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute… |
CVE-2019-4609 | High | 7.5 | 2019-12-18 | IBM API Connect 2018.4.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2019-4560 | Medium | 6.5 | 2019-12-16 | IBM MQ and IBM MQ Appliance 9.1 CD, 9.1 LTS, 9.0 LTS, and 8.0 is vulnerable to a denial of service attack caused by channels processing poorly formatted messag… |
CVE-2019-4444 | Medium | 5.5 | 2019-12-16 | IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the brow… |
CVE-2019-4426 | Medium | 5.4 | 2019-12-13 | The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerabil… |
CVE-2019-4606 | High | 7.8 | 2019-12-12 | IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system, caused by an untrusted search pa… |
CVE-2019-4715 | High | 8.8 | 2019-12-11 | IBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request… |
CVE-2019-4665 | Medium | 5.4 | 2019-12-11 | IBM Spectrum Scale 4.2 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2019-4663 | Medium | 5.4 | 2019-12-10 | IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2019-4521 | Critical | 9.8 | 2019-12-10 | Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the syste… |
CVE-2019-4244 | Critical | 9.1 | 2019-12-10 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zookeeper installatio… |
CVE-2019-4095 | Medium | 4.3 | 2019-12-10 | IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted fr… |
CVE-2019-4621 | Critical | 9.8 | 2019-12-09 | IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is… |
CVE-2019-4612 | High | 8.8 | 2019-12-09 | IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious execut… |