IBM
Page 41 of 87 — IBM CVEs from a corpus of 8644, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-4249 | Medium | 5.4 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2019-4084 | Medium | 4.3 | 2019-06-27 | IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) could allow an authenticated user to obtain sensitive inform… |
CVE-2019-4083 | Medium | 5.4 | 2019-06-27 | IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) is vulnerable to cross-site scripting. This vulnerability al… |
CVE-2018-1893 | Medium | 5.4 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2018-1892 | Medium | 5.4 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2018-1828 | Medium | 5.4 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2018-1827 | Medium | 5.4 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2018-1826 | Medium | 5.4 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2018-1760 | Medium | 5.4 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2018-1758 | Medium | 5.4 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2018-1734 | Medium | 4.3 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 discloses sensitive information in error messages that may be used by a malicious user to o… |
CVE-2019-4241 | High | 7.8 | 2019-06-26 | IBM PureApplication System 2.2.3.0 through 2.2.5.3 could allow an authenticated user with local access to bypass authentication and obtain administrative acces… |
CVE-2019-4235 | High | 7.5 | 2019-06-26 | IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default, which makes it easier for attackers to… |
CVE-2019-4234 | Medium | 4.3 | 2019-06-26 | IBM PureApplication System 2.2.3.0 through 2.2.5.3 weakness in the implementation of locking feature in pattern editor. An attacker by intercepting the subsequ… |
CVE-2019-4225 | Medium | 4.4 | 2019-06-26 | IBM PureApplication System 2.2.3.0 through 2.2.5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 15… |
CVE-2019-4224 | High | 8.8 | 2019-06-26 | IBM PureApplication System 2.2.3.0 through 2.2.5.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could a… |
CVE-2019-4382 | Medium | 5.3 | 2019-06-25 | IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP re… |
CVE-2019-4377 | Medium | 4.3 | 2019-06-25 | IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM… |
CVE-2019-4158 | Medium | 5.4 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 does not prove that a user's identity is correct which can lead to the exposure of resources or functionality t… |
CVE-2019-4157 | Medium | 6.1 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in th… |
CVE-2019-4156 | Medium | 5.9 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2019-4153 | Medium | 6.8 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victi… |
CVE-2019-4152 | Medium | 4.4 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. The lack of proper session expiration may allow attacker… |
CVE-2019-4151 | Medium | 5.9 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inf… |
CVE-2019-4150 | Low | 3.7 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted ent… |
CVE-2019-4145 | High | 7.1 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 could reveal highly sensitive in specialized conditions to a local user which could be used in further attacks… |
CVE-2019-4135 | High | 8.8 | 2019-06-25 | IBM Security Access Manager 9.0.1 through 9.0.6 is affected by a security vulnerability that could allow authenticated users to impersonate other users. IBM X-… |
CVE-2018-2013 | Medium | 5.3 | 2019-06-25 | IBM API Connect 2018.1 through 2018.4.1.5 could disclose sensitive information to an unauthorized user that could aid in further attacks against the system. IB… |
CVE-2018-2011 | Medium | 5.3 | 2019-06-25 | IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attac… |
CVE-2018-1858 | High | 8.8 | 2019-06-25 | IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2019-4385 | Medium | 6.5 | 2019-06-19 | IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to… |
CVE-2019-4384 | Medium | 4.3 | 2019-06-19 | IBM Campaign 9.1.2 and 10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request contain… |
CVE-2019-4364 | High | 8.0 | 2019-06-19 | IBM Maximo Asset Management 7.6 is vulnerable to CSV injection, which could allow a remote authenticated attacker to execute arbirary commands on the system. I… |
CVE-2019-4303 | Medium | 5.4 | 2019-06-19 | IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2017-1107 | Medium | 4.3 | 2019-06-19 | IBM Marketing Platform 9.1.0, 9.1.2, 10.0, and 10.1 exposes sensitive information in the headers that could be used by an authenticated attacker in further att… |
CVE-2019-4142 | High | 8.8 | 2019-06-18 | IBM Cloud Private 2.1.0, 3.1.0, 3.1.1, and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorize… |
CVE-2019-4177 | Low | 3.3 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-F… |
CVE-2019-4176 | Medium | 5.3 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to bypass security restrictions, caused by an error related to i… |
CVE-2019-4174 | Low | 3.3 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-F… |
CVE-2019-4173 | Medium | 6.5 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OP… |
CVE-2019-4136 | Medium | 5.4 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java… |
CVE-2019-4103 | High | 8.0 | 2019-06-17 | IBM Tivoli Netcool/Impact 7.1.0 allows for remote execution of command by low privileged User. Remote code execution allow to execute arbitrary code on system… |
CVE-2018-1845 | High | 7.1 | 2019-06-17 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacke… |
CVE-2019-4403 | Medium | 5.4 | 2019-06-14 | IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the i… |
CVE-2019-4381 | Medium | 5.5 | 2019-06-14 | IBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information, caused by the use of advanced node failure detection using the REST API t… |
CVE-2019-4239 | Medium | 5.5 | 2019-06-14 | IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in plain in clear text which can be read by a local user. IBM X-Force… |
CVE-2019-4070 | Medium | 5.4 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip… |
CVE-2019-4069 | High | 8.8 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Forc… |
CVE-2019-4068 | High | 7.5 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force… |
CVE-2019-4067 | High | 7.5 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for atta… |
CVE-2019-4066 | High | 8.8 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues a… |
CVE-2019-4257 | Medium | 4.3 | 2019-06-06 | IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive information in an error message may be used t… |
CVE-2019-4219 | Medium | 5.3 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be used in further atta… |
CVE-2019-4218 | Low | 3.3 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Forc… |
CVE-2019-4217 | Medium | 6.1 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim… |
CVE-2019-4162 | High | 7.5 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencr… |
CVE-2019-4161 | Low | 3.3 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 discloses sensitive information to unauthorized users. The information can be used to mount furth… |
CVE-2019-4220 | Medium | 5.5 | 2019-06-06 | IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 15922… |
CVE-2019-4201 | Medium | 6.1 | 2019-06-06 | IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persua… |
CVE-2019-4185 | High | 8.3 | 2019-06-06 | IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configured component. IBM X-Force ID: 158975. |
CVE-2019-4056 | Medium | 4.3 | 2019-06-06 | IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious files. IBM X-Force ID… |
CVE-2019-4048 | Low | 2.1 | 2019-06-06 | IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force… |
CVE-2018-2028 | Medium | 6.5 | 2019-06-06 | IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which could allow the attacker to obtain high… |
CVE-2019-4264 | Medium | 5.9 | 2019-05-29 | IBM QRadar SIEM 7.2.8 WinCollect could allow an attacker to obtain sensitive information by spoofing a trusted entity using man in the middle techniques due to… |
CVE-2019-4256 | High | 7.5 | 2019-05-29 | IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2019-4184 | Medium | 5.4 | 2019-05-29 | IBM Jazz Reporting Service 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2019-4139 | Medium | 5.4 | 2019-05-29 | IBM Cognos Analytics 11.0, 11.1.0, and 11.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2019-4138 | Medium | 5.9 | 2019-05-29 | IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly… |
CVE-2019-4137 | Medium | 6.1 | 2019-05-29 | IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScr… |
CVE-2019-4078 | High | 7.8 | 2019-05-23 | IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect… |
CVE-2019-4039 | Medium | 5.5 | 2019-05-23 | IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local attacker to cause a denial of service within the error log reporting sys… |
CVE-2018-1991 | Low | 2.7 | 2019-05-22 | IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CM… |
CVE-2019-4293 | Medium | 5.3 | 2019-05-20 | IBM Storwize V7000 Unified (2073) 1.6 configuration may allow an attacker to reveal the server version in default installation, which could be used in further… |
CVE-2019-4058 | Medium | 6.5 | 2019-05-20 | IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements and information normally restricted to a… |
CVE-2019-4011 | Medium | 5.4 | 2019-05-20 | IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2018-2005 | Low | 3.3 | 2019-05-20 | IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions. IB… |
CVE-2019-4279 | Critical | 9.8 | 2019-05-17 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of seriali… |
CVE-2019-4119 | Medium | 5.3 | 2019-05-17 | IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1, and 3.1.2 can be used as an HTTP proxy to not only cluster internal but also external target IP ad… |
CVE-2018-1975 | Medium | 5.4 | 2019-05-16 | IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar… |
CVE-2019-4259 | Medium | 5.5 | 2019-05-13 | A security vulnerability has been identified in IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 with CES stack enabled that could allow sensiti… |
CVE-2019-4204 | Medium | 5.4 | 2019-05-10 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb… |
CVE-2018-1990 | Medium | 5.3 | 2019-05-10 | IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a specially crafted HT… |
CVE-2018-1790 | Medium | 4.3 | 2019-05-10 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to ex… |
CVE-2019-4072 | Medium | 6.3 | 2019-05-09 | IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even whe… |
CVE-2019-4071 | High | 8.8 | 2019-05-09 | IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute arbitrary commands… |
CVE-2019-4208 | High | 7.1 | 2019-05-07 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2019-4207 | Low | 3.3 | 2019-05-07 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in further attacks agains… |
CVE-2018-2008 | Medium | 4.3 | 2019-05-07 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further attacks against the sy… |
CVE-2018-2001 | Medium | 4.3 | 2019-05-07 | IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciou… |
CVE-2018-2015 | Medium | 6.4 | 2019-05-02 | IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious We… |
CVE-2019-4258 | Medium | 5.4 | 2019-05-01 | IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java… |
CVE-2018-1933 | Medium | 5.4 | 2019-05-01 | IBM Planning Analytics 2.0 through 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2018-1608 | Medium | 5.9 | 2019-05-01 | IBM Rational Engineering Lifecycle Manager 6.0 through 6.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2019-4166 | Medium | 6.1 | 2019-04-30 | IBM StoredIQ 7.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted… |
CVE-2019-4047 | Medium | 4.3 | 2019-04-29 | IBM Jazz Reporting Service (JRS) 6.0.6 could allow an authenticated user to access the execution log files as a guest user, and obtain the information of the s… |
CVE-2018-2007 | Medium | 5.9 | 2019-04-29 | IBM API Connect 2018.1 and 2018.4.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2018-2004 | Medium | 5.4 | 2019-04-29 | IBM Jazz Reporting Service (JRS) 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2018-1961 | Medium | 5.3 | 2019-04-29 | IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages. IBM X-Force ID: 153657. |
CVE-2019-4238 | Medium | 5.4 | 2019-04-25 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod… |
CVE-2019-4222 | Medium | 4.3 | 2019-04-25 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without per… |