CVE-2023-27559

IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted subquery. IBM X-Force ID: 249196.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Db2 Linux Kernel Windows

CVE-2024-40690

IBM InfoSphere Server cross-site scripting

IBM InfoSphere Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 297720.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Infosphere Information Server

CVE-2024-40689

IBM InfoSphere Information Server SQL injection

IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. IBM X-Force ID: 297719.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Infosphere Information Server Infosphere Information Server On Cloud

CVE-2024-39743

IBM MQ Container denial of service

IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 297172.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Mq Operator

CVE-2024-39742

IBM MQ Container authentication bypass

IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Mq Operator

CVE-2024-39741

IBM Datacap Navigator directory traversal

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 296010.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap Datacap Navigator

CVE-2024-39740

IBM Datacap Navigator information disclosure

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 displays version information in HTTP requests that could allow an attacker to gather information for future attacks against the system. IBM X-Force ID: 296009.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap Datacap Navigator

CVE-2024-39739

IBM Datacap Navigator server-side request forgery

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 296008.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap Datacap Navigator

CVE-2024-39737

IBM Datacap Navigator information disclosure

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 296004.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap Datacap Navigator

CVE-2024-39736

IBM Datacap Navigator HTTP HOST header injection

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 296003.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap Datacap Navigator

CVE-2024-39735

IBM Datacap Navigator cross-site scripting

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 296002.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap Datacap Navigator

CVE-2024-39733

IBM Datacap Navigator information disclosure

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 295972.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap

CVE-2024-39732

IBM Datacap Navigator information disclosure

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious user. IBM X-Force ID: 295791.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap

CVE-2024-39731

IBM Datacap Navigator information disclosure

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 295970.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap

CVE-2024-39729

IBM Datacap Navigator information disclosure

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow an authenticated user to obtain sensitive information from source code that could be used in further attacks against the system. IBM X-Force ID: 295968.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap Datacap Navigator

CVE-2024-39728

IBM Datacap Navigator cross-site scripting

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 295967.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Datacap Datacap Navigator

CVE-2024-39723

IBM FlashSystem denial of service

IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the system could use the USB port to cause loss of access to data. IBM X-Force ID: 295935.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Storage Virtualize

CVE-2024-38330

IBM i privilege escalation

IBM System Management for i 7.2, 7.3, and 7.4 could allow a local user to gain elevated privileges due to an unqualified library program call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 295227.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2024-38329

IBM Storage Protect for Virtual Environments: Data Protection for VMware security bypass

IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this vulnerability to change its settings, trigger backups, restore backups, and also delete all previous backups via log rotation. IBM X-Force ID: 294994.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Storage Protect For Virtual Environments

CVE-2024-38322

IBM Storage Defender information disclosure

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Storage Defender Resiliency Service