Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,876

Export CSV
CVE-2024-43189

IBM Concert Software information disclosure

IBM Concert Software 1.0.0 through 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Concert
CVE-2024-31890

IBM i privilege escalation

IBM i 7.3, 7.4, and 7.5 product IBM TCP/IP Connectivity Utilities for i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain root access to the host operating system. IBM X-Force ID: 288171.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I
CVE-2024-41743

IBM TXSeries for Multiplatforms denial of service

IBM TXSeries for Multiplatforms 10.1 could allow a remote attacker to cause a denial of service using persistent connections due to improper allocation of resources.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm Linux
Products
Txseries For Multiplatforms Linux Kernel
CVE-2024-41742

IBM TXSeries for Multiplatforms denial of service

IBM TXSeries for Multiplatforms 10.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm Linux
Products
Txseries For Multiplatforms Linux Kernel
CVE-2024-45654

IBM Security ReaQta improper input validation

IBM Security ReaQta 3.12 could allow an authenticated user to perform unauthorized actions due to reliance on untrusted inputs.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Linux
Products
Security Qradar Edr Linux Kernel
CVE-2024-45100

IBM Security QRadar EDR denial of service

IBM Security ReaQta 3.12 could allow a privileged user to cause a denial of service by sending multiple administration requests due to improper allocation of resources.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Linux
Products
Security Qradar Edr Linux Kernel
CVE-2024-45640

IBM Security QRadar EDR information disclosure

IBM Security ReaQta 3.12 returns sensitive information in an HTTP response that could be used in further attacks against the system.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Linux
Products
Security Qradar Edr Linux Kernel
CVE-2024-28770

IBM Security Directory Integrator information disclosure

IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Directory Integrator Security Verify Directory Integrator
CVE-2024-28771

IBM Security Directory Integrator information disclosure

IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Directory Integrator Security Verify Directory Integrator
CVE-2023-25681

IBM Spectrum Virtualize security bypass

LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. This does not affect local users with MFA configured or remote users authenticating via single sign-on. IBM X-Force ID: 247033.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Spectrum Virtualize
CVE-2023-35899

IBM Cloud Pak for Automation CSV injection

IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Pak For Automation Cloud Pak For Business Automation
CVE-2024-35146

IBM Maximo Application Suite cross-site scripting

IBM Maximo Application Suite - Monitor Component 8.10.11, 8.11.8, and 9.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Maximo Application Suite
CVE-2024-35144

IBM Maximo Application Suite information disclosure

IBM Maximo Application Suite 8.10, 8.11, and 9.0 - Monitor Component stores source code on the web server that could aid in further attacks against the system.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Maximo Application Suite
CVE-2024-35145

IBM Maximo Application Suite cross-site scripting

IBM Maximo Application Suite 9.0.0 - Monitor Component is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Maximo Application Suite
CVE-2024-35150

IBM Maximo Application Suite log manipulation

IBM Maximo Application Suite 8.10.12, 8.11.0, 9.0.1, and 9.1.0 - Monitor Component does not neutralize output that is written to logs, which could allow an attacker to inject false log entries.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Maximo Application Suite
CVE-2024-38314

IBM Maximo Application Suite - Monitor Component information disclosure

IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised environment.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Maximo Application Suite
CVE-2024-56467

IBM EntireX information disclosure

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Ibm Linux Microsoft
Products
Entirex Linux Kernel Windows