Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,876

Export CSV
CVE-2023-30444

IBM Watson Machine Learning on Cloud Pak for Data server-side request forgery

IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 253350.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Watson Machine Learning On Cloud Pak For Data
CVE-2023-24966

IBM WebSphere Application Server cross-site scripting

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246904.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2023-27860

IBM Maximo Asset Management information disclosure

IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message. This information could be used in further attacks against the system. IBM X-Force ID: 249207.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Maximo Asset Management
CVE-2023-27556

IBM Safer Payments denial of service

IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocate resources without limits or throttling which could allow a remote attacker to cause a denial of service. IBM X-Force ID: 249190.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Ibm
Products
Safer Payments
CVE-2020-4729

IBM Safer Payments denial of service

IBM Counter Fraud Management for Safer Payments 5.7.0.00 through 5.7.0.10, 6.0.0.00 through 6.0.0.07, 6.1.0.00 through 6.1.0.05, and 6.2.0.00 through 6.2.1.00 could allow an authenticated attacker under special circumstances to send multiple specially crafted API requests that could cause the application to crash. IBM X-Force ID: 188052.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Safer Payments
CVE-2023-27557

IBM Safter Payments information disclosure

IBM Counter Fraud Management for Safer Payments 6.1.0.00 through 6.1.1.02, 6.2.0.00 through 6.2.2.02, 6.3.0.00 through 6.3.1.02, 6.4.0.00 through 6.4.2.01, and 6.5.0.00 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 249192.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Safer Payments
CVE-2023-27864

IBM Maximo Asset Management HTML injection

IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 249327.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Maximo Asset Management
CVE-2023-25930

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 11.1, and 11.5 is vulnerable to a denial of service. Under rare conditions, setting a special register may cause the Db2 server to terminate abnormally. IBM X-Force ID: 247862.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Linux Microsoft
Products
Db2 Linux Kernel Windows
CVE-2022-43871

IBM Financial Transaction Manager for SWIFT Services cross-site scripting

IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 239707.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Financial Transaction Manager For Multiplatform
CVE-2024-22359

IBM UrbanCode Deploy cross-site scripting

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 280897.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Devops Deploy Urbancode Deploy
CVE-2024-22358

IBM UrbanCode Deploy session fixation

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 280896.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Devops Deploy Urbancode Deploy
CVE-2024-22339

IBM UrbanCode Deploy information disclosure

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 is vulnerable to a sensitive information due to insufficient obfuscation of sensitive values from some log files. IBM X-Force ID: 279979.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Devops Deploy Urbancode Deploy
CVE-2024-22334

IBM UrbanCode Deploy improper privilege control

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type. When deleting a custom security type, associated permissions of objects using that type may not be fully revoked. This could lead to incorrect reporting of permission configuration and unexpected privileges being retained. IBM X-Force ID: 279974.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Devops Deploy Urbancode Deploy
CVE-2023-26282

IBM Watson CP4D Data Stores file modificiation

IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the system to modify files or data on the system. IBM X-Force ID: 248415.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Watson Cp4d Data Stores
CVE-2023-28512

IBM Watson CP4D Data Stores improper input validation

IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input validation. IBM X-Force ID: 250396.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Watson Cp4d Data Stores
CVE-2024-49806

IBM Security Verify Access Appliance hard coded credentials

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access
CVE-2024-49805

IBM Security Verify Access Appliance hard coded credentials

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access
CVE-2024-49804

IBM Security Verify Access Appliance privilege escalation

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a locally authenticated non-administrative user to escalate their privileges due to unnecessary permissions used to perform certain tasks.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access