Ibm

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-55913 1Ibm 1Concert Jun 17, 2026 May 2, 2025 N/A· v4 5.3 MEDIUM· v3 N/A· v2 IBM Concert Software 1.0.0 through 1.0.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary...Show more IBM Concert Software 1.0.0 through 1.0.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.Show less
CVE-2024-55912 1Ibm 1Concert Jun 17, 2026 May 2, 2025 N/A· v4 5.9 MEDIUM· v3 N/A· v2 IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVE-2024-55910 1Ibm 1Concert Jun 17, 2026 May 2, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumera...Show more IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.Show less
CVE-2024-55909 1Ibm 1Concert Jun 17, 2026 May 2, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expansion of archive files without controlling resource consumption.
CVE-2024-52903 1Ibm 1Db2 Jun 17, 2026 May 1, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
CVE-2025-27365 1Ibm 2Mq Operator Supplied Mq Advanced Container Images Jun 17, 2026 May 1, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 Client connecting to a MQ Queue Manager can cause...Show more IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 Client connecting to a MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it.Show less
CVE-2025-1333 1Ibm 2Mq Operator Supplied Mq Advanced Container Images Jun 17, 2026 May 1, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 and configured...Show more IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 and configured with Cloud Pak for Integration Keycloak could disclose sensitive information to a privileged user.Show less
CVE-2025-1551 1Ibm 1Operational Decision Manager Jun 17, 2026 Apr 29, 2025 N/A· v4 6.1 MEDIUM· v3 N/A· v2 IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, and 9.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thu...Show more IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, and 9.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.Show less
CVE-2025-2986 1Ibm 1Maximo Asset Management Jun 17, 2026 Apr 25, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pote...Show more IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.Show less
CVE-2025-25046 1Ibm 1Infosphere Information Server Jun 17, 2026 Apr 23, 2025 N/A· v4 3.7 LOW· v3 N/A· v2 IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be exposed to an unauthorized actor using man in the middle techniques.
CVE-2025-25045 1Ibm 1Infosphere Information Server Jun 17, 2026 Apr 23, 2025 N/A· v4 4.3 MEDIUM· v3 N/A· v2 IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further attacks against the s...Show more IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further attacks against the system.Show less
CVE-2024-22351 1Ibm 1Infosphere Information Server Jun 17, 2026 Apr 23, 2025 N/A· v4 6.3 MEDIUM· v3 N/A· v2 IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
CVE-2025-27907 1Ibm 1Websphere Application Server Jun 17, 2026 Apr 22, 2025 N/A· v4 2.7 LOW· v3 N/A· v2 IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enu...Show more IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.Show less
CVE-2025-1951 1Ibm 1Hardware Management Console Jun 17, 2026 Apr 22, 2025 N/A· v4 6.7 MEDIUM· v3 N/A· v2 IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands as a privileged user due to execution of commands with unnecessary privileges.
CVE-2025-1950 1Ibm 1Hardware Management Console Jun 17, 2026 Apr 22, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 IBM Hardware Management Console - Power Systems V10.2.1030.0 and V10.3.1050.0 could allow a local user to execute commands locally due to improper validation of libraries of an untrusted source.
CVE-2025-2987 1Ibm 1Maximo Asset Management Jun 17, 2026 Apr 22, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration...Show more IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.Show less
CVE-2025-2950 1Ibm 1I Jun 17, 2026 Apr 18, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP r...Show more IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior.Show less
CVE-2024-49808 1Ibm 1Sterling Connect Direct Web Services Jun 17, 2026 Apr 18, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restricti...Show more IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions.Show less
CVE-2024-45651 1Ibm 1Sterling Connect Direct Web Services Jun 17, 2026 Apr 18, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.
CVE-2025-2947 1Ibm 1I Jun 17, 2026 Apr 17, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 IBM i 7.6 contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the command to elevate privileges to gain root access to the host operating system.

Previous 1...323334...413 Next