Summary
Ein Angreifer kann mehrere Schwachstellen in IBM i ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode auszuführen.
Product
IBM i (früher bekannt als IBM iSeries oder IBM System i) ist ein Betriebssystem, das auf IBM Power Systems Servern läuft und für Geschäftsanwendungen entwickelt wurde.
Vulnerabilities 81
-
Critical 9.6
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.
-
High 8.9
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input.
-
High 8.9
IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses.
-
High 8.8
IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.
-
High 8.8
IBM i is Affected By Multiple Vulnerabilities in Domain Name System
IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in an OS command.
-
High 8.8
IBM i is Affected By Multiple Vulnerabilities in Domain Name System
IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command.
-
High 8.8
IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due to an out-of-bounds write.
-
High 8.8
IBM i is Affected By Multiple Vulnerabilities in SQL
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management.
-
High 8.8
IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
-
High 8.8
IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.
-
High 8.8
IBM i is Affected By privilege escalation in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.
-
High 8.8
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.
-
High 8.8
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i.
-
High 8.6
IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow.
-
High 8.6
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
-
High 8.4
IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses.
-
High 8.3
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection.
-
High 8.3
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.
-
High 8.3
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation.
-
High 8.2
IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.
-
High 8.2
IBM i is Affected By A Prvilege Escalation Vulnerability []
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated pri…
-
High 8.1
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation.
-
High 8.1
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing.
-
High 8.1
IBM i is Affected By improper privilege management in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment.
-
High 8.1
IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management.
-
High 8.1
IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens.
-
High 8.1
IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.
-
High 8.1
IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
-
High 8.1
IBM i is Affected By XML injection flaw in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw.
-
High 7.8
IBM i is Affected By Multiple Vulnerabilities in Network Authentication Service
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.
-
High 7.6
IBM i is Affected By Multiple Vulnerabilities in SQL
IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
-
High 7.5
IBM i is Affected By A Denial of Service Vulnerability []
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.
-
High 7.5
IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
-
High 7.5
IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.
-
High 7.5
IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation.
-
High 7.5
IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.
-
High 7.5
IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.
-
High 7.5
IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one of the host servers, a remote attacker could leverage this vulnerability to cause a denial-of-server (DoS) for that ser…
-
High 7.3
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.
-
High 7.3
IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-l…
-
High 7.1
IBM i is Affected By Multiple Vulnerabilities in Network Authentication Service
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use (TOCTOU) race condition.
-
Medium 6.8
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token.
-
Medium 6.5
IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.
-
Medium 6.5
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
-
Medium 6.5
IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authentication tokens.
-
Medium 6.5
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
-
Medium 6.5
IBM i is Affected By Multiple Vulnerabilities in SQL
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command.
-
Medium 6.5
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in request processing. The attacker could exploit this vulnerability to cause a temporary den…
-
Medium 6.5
IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.
-
Medium 6.4
IBM i is Affected By Stored Cross-site Scripting for i
IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure …
-
Medium 6.3
IBM i is Affected By Multiple Vulnerabilities in SQL
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements in an SQL parameter.
-
Medium 6.3
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race condition.
-
Medium 5.4
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
-
Medium 5.4
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read.
-
Medium 5.3
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
-
Medium 5.3
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
-
Medium 5.3
IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow.
-
Medium 5.3
IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper processing of DRDA and DDM resynchronization requests.
-
Medium 5.3
IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable.
-
Medium 5.3
IBM i is Affected By A Denial of Service Vulnerability in DRDA / DDM []
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion.
-
Medium 5.3
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
-
Medium 5.3
IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA large-object headers.
-
Medium 5.3
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
-
Medium 5.3
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.
-
Medium 4.8
IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write.
-
Medium 4.5
IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking.
-
Medium 4.4
IBM i is Affected By An Improper Privilege Management Vulnerability in LDAP []
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap buffer overflow.
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
-
Medium 4.3
IBM i is Affected By Path Traversal Vulnerability in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability.
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in SQL
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection.
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in SQL
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command.
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion.
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input.
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log files due to improper output neutralization for logs.
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition.
-
Low 3.8
IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.
-
Low 3.1
IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management.
-
Low 3.0
IBM i is Affected By security restrictions bypass in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser.
-
Low 2.7
IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal.
Revision history
-
#2
Referenz(en) aufgenommen: CVE-2026-17101, EUVD-2026-58399, CVE-2026-17099, EUVD-2026-58398, EUVD-2026-58239, EUVD-2026-58237, EUVD-2026-58236, EUVD-2026-58235, EUVD-2026-58234, EUVD-2026-58233, EUVD-2026-58232, EUVD-2026-58231, EUVD-2026-58230, EUVD-2026-58403, EUVD-2026-58402, EUVD-2026-58401, EUVD-2026-58397, EUVD-2026-58395, EUVD-2026-58394, EUVD-2026-58393, EUVD-2026-58392, EUVD-2026-58389, EUVD-2026-58387, EUVD-2026-58386, EUVD-2026-58379, EUVD-2026-58376, EUVD-2026-58375, EUVD-2026-58374, EUVD-2026-58373, EUVD-2026-58372, EUVD-2026-58371, EUVD-2026-58369, EUVD-2026-58365, EUVD-2026-58364, EUVD-2026-58238, EUVD-2026-58467, EUVD-2026-58466, EUVD-2026-58465, EUVD-2026-58464, EUVD-2026-58463, EUVD-2026-58462, EUVD-2026-58461, EUVD-2026-58460, EUVD-2026-58457, EUVD-2026-58455, EUVD-2026-58453, EUVD-2026-58388, EUVD-2026-58368, EUVD-2026-58474, EUVD-2026-58473, EUVD-2026-58470, EUVD-2026-58469, EUVD-2026-58468, EUVD-2026-58396, EUVD-2026-58378
-
#1
Initiale Fassung
References
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283284
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283288
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283289
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283292
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283569
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283571
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283572
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283573
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283578
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283273
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283279
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283283
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283285
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283286
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283291
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283293
-
IBM Security Bulletin vom 2026-08-12
https://www.ibm.com/support/pages/node/7283479