Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,876

Export CSV
CVE-2023-29260

IBM Sterling Connect:Express for UNIX server-side request forgery

IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 252135.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Linux Microsoft and 1 more
Products
Aix Sterling Connect\ Linux Kernel and 2 more
CVE-2023-29259

IBM Sterling Connect:Express for UNIX information disclosure

IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID: 252055.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Ibm Linux Microsoft and 1 more
Products
Aix Sterling Connect\ Linux Kernel and 2 more
CVE-2023-28958

IBM Watson Knowledge Catalog CSV injection

IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 251782.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Watson Knowledge Catalog On Cloud Pak For Data
CVE-2023-28955

IBM Watson Knowledge Catalog denial of service

IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service. IBM X-Force ID: 251704.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Watson Knowledge Catalog On Cloud Pak For Data
CVE-2023-28949

IBM Engineering Requirements Management cross-site request forgery

IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 251216.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Engineering Requirements Management Doors Engineering Requirements Management Doors Web Access
CVE-2023-28525

IBM Engineering Requirements Management cross-site scripting

IBM Engineering Requirements Management 9.7.2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 251052.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Engineering Requirements Management Doors Engineering Requirements Management Doors Web Access
CVE-2023-28513

IBM MQ denial of service

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vulnerable to a denial of service attack caused by an error processing messages. IBM X-Force ID: 250397.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hp Ibm Linux and 2 more
Products
Hp-ux Aix I and 6 more
CVE-2023-27877

IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure

IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database. IBM X-Force ID: 247905.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Pak For Data
CVE-2023-27866

IBM Informix JDBC code execution

IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511.

CVSS 3.1 · 6.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Ibm
Products
Informix Jdbc Driver
CVE-2023-27540

IBM Watson CP4D Data Stores denial of service

IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specific to the system to cause a denial of service. IBM X-Force ID: 248924.

CVSS 3.1 · 5.9 Medium EPSS 1.3% KEV · Not listed
Vendors
Ibm Redhat
Products
Cloud Pak For Data Watson Cp4d Data Stores Openshift
CVE-2023-27279

IBM Aspera Faspex denial of service

IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting. IBM X-Force ID: 248533.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aspera Faspex
CVE-2023-26289

IBM Aspera Orchestrator HTTP header injection

IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 248478.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aspera Orchestrator
CVE-2023-26288

IBM Aspera Orchestrator session fixation

IBM Aspera Orchestrator 4.0.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 248477.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aspera Orchestrator
CVE-2023-26286

IBM AIX privilege escalation

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX runtime services library to execute arbitrary commands. IBM X-Force ID: 248421.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aix Vios
CVE-2023-26279

IBM QRadar WinCollect Agent improper output encoding

IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a local user to perform unauthorized actions due to improper encoding. IBM X-Force ID: 248160.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Qradar Wincollect
CVE-2023-26274

IBM QRadar cross-site scripting

IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 248144.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Linux
Products
Qradar Security Information And Event Manager Linux Kernel