Skip to content
OpenAdvisories

Vendor

Open Mainframe Project

7 known vulnerabilities.

Open Mainframe Project at a glance

Last 12 months
0
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Zowe 6 Zowe CLI - Imperative 1
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 5.3
    CVE-2024-9802

    Conformance validation endpoint discloses detail about service to unauthenticated users

    The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running versi…

    Open Mainframe Project Zowe
  • Medium 5.3
    CVE-2024-9798

    Health endpoint offers list of onboarded services to unauthenticated users

    The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers.

    Open Mainframe Project Zowe
  • Medium 5.9
    CVE-2024-6916

    Zowe CLI --show-inputs-only displays securely stored properties

    A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the '--show-inputs-only' flag.

    Open Mainframe Project Zowe CLI - Imperative
  • Critical 9.0
    CVE-2024-6834

    Imperative Local Command Injection allows Activity Masking

    A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. I…

    Open Mainframe Project Zowe
  • Medium 5.9
    CVE-2024-6833

    Zowe CLI Auto-Init Leaks Credentials Locally

    A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation.

    Open Mainframe Project Zowe @zowe/cli npm
  • Low 3.3
    CVE-2021-4326

    Imperative Local Command Injection allows Activity Masking

    A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.

    Open Mainframe Project Zowe @zowe/imperative npm
  • Medium 5.3
    CVE-2021-4314

    It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT t…

    Open Mainframe Project Zowe