405,427 results · Feed
-
Medium 4.3
IBM Verify Directory is affected by multiple vulnerabilities
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versio…
-
Low 3.5
IBM Verify Directory is affected by multiple vulnerabilities
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers …
-
High 8.8
IBM Verify Directory is affected by multiple vulnerabilities
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the…
-
Low 3.1
IBM Guardium Data Protection is affected by multiple vulnerabilities
IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
-
Medium 6.5
IBM Guardium Data Protection is affected by multiple vulnerabilities
IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests.
-
Low 3.1
IBM Guardium Data Protection is affected by multiple vulnerabilities
IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
-
Medium 5.6
IBM Guardium Data Protection is affected by multiple vulnerabilities
IBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
-
Medium 6.7
IBM Guardium Data Protection is affected by multiple vulnerabilities
IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters.
-
Medium 6.4
DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.
-
Medium 4.9
Sensitive Information in Log files affects IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to obtain sensitive information due to imprope…
-
Medium 5.0
DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
-
Medium 4.3
IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.
-
Medium 6.8
IBM Guardium Key Lifecycle Manager is affected by a security vulnerability
IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 could allow a local attacker to obtain sensitive information due to the use of a weak cryptographic algorithm.
-
Medium 4.8
IBM i is Affected By Missing Authorization Vulnerability in Host-Based Printer Subsystem []
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they should not be able to …
-
Medium 4.3
Multiple vulnerabilities in IBM Content Navigator and FasterXML jackson-databind in IBM Content Navigator
IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection. A remote authenticated attacker could send a specially crafted request that could allow enumeration of LDAP directory information.
-
Critical 9.8
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the…
-
Medium 6.5
Vulnerabilities exists in IBM Cloud Pak for Data System
IBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001 through - 11.3.1.2 Interim Fix 002 could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments.
-
Medium 4.3
Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, …
-
Medium 6.5
Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access r…
-
Medium 4.3
Improper Authorization vulnerability affects IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1, and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to access unauthorized page…
-
High 8.1
TS4500 Tape Library addresses security vulnerability
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due to improper authorization.
-
High 7.1
CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities
IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.
-
Medium 5.4
CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities
IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, poten…
-
Medium 6.5
Protection Mechanism Failure vulnerability affects IBM Sterling File Gateway
IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 - 6.2.2.1_1 could allow a remote attacker to perform protocol downgrade attacks due to a security misconfiguration.
-
Medium 4.9
IBM Sterling Secure Proxy is vulnerable to multiple issues
IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validation of listener IP address and port.
-
Medium 6.5
IBM ContextForge MCP Gateway is affected by a denial-of-service via tool name collision through slug normalization
IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions.
-
Medium 5.4
IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization.
-
Medium 4.2
IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages.
-
Low 2.5
IBM App Connect Enterprise is vulnerable to a clickjacking attack
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls.
-
High 7.5
IBM App Connect Enterprise is vulnerable to a credential exposure
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control.
-
Critical 9.1
IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities
IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
-
Medium 5.5
IBM App Connect Enterprise is vulnerable to an arbitrary file write
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.
-
Medium 6.5
Vulnerability exists in IBM Netezza Appliance
IBM Netezza Appliance 11.3.0.2 Interim Fix 002 through 11.3.1.3 Interim Fix 006 could allow a remote authenticated attacker to change the passwords of other users due to improper authorization.
-
Medium 6.5
DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
-
Medium 6.5
DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
-
Medium 4.4
DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.
-
Critical 9.8
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.
-
Medium 4.3
IBM Cognos Command Center has addressed vulnerabilities
IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to execute unauthorized processes due to cross-site request forgery.
-
Medium 6.0
The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher
IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, and 5.2.3.0 through 5.2.3.8 could allow an attacker to leverage an undocumented flag to gain access to an unauthenticated path in the …
-
Medium 5.4
IBM Storage Scale Incorrect Authorization
IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization.