Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,855

Export CSV
CVE-2022-43845

IBM Aspera Console information disclosure

IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Ibm Linux Microsoft
Products
Aspera Console Linux Kernel Windows
CVE-2021-38963

IBM Aspera Console CSV injection

IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerability. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Ibm Linux Microsoft
Products
Aspera Console Linux Kernel Windows
CVE-2024-38324

IBM Storage Defender improper certificate validation

IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which could expose sensitive information to an attacker with access to the system.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Storage Defender Storage Defender Resiliency Service
CVE-2024-43188

IBM Business Automation Workflow improper input validation

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Business Automation Workflow
CVE-2024-40703

IBM Cognos Analytics information disclosure

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a local attacker to obtain sensitive information in the form of an API key. An attacker could use this information to launch further attacks against affected applications.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cognos Analytics Cognos Analytics Reports
CVE-2024-37068

IBM Maximo Application Suite information disclosure

IBM Maximo Application Suite - Manage Component 8.10, 8.11, and 9.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information using man in the middle techniques.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Maximo Application Suite
CVE-2024-35133

IBM Security Verify Access HTTP open redirect

IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

CVSS 3.1 · 6.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access Security Verify Access Docker
CVE-2024-28799

IBM QRadar Suite Software information disclosure

IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 displays sensitive data improperly to a local privileged user, in non default configurations, during back-end commands which may result in the unexpected disclosure of this information. IBM X-Force ID: 287173.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Pak For Security Qradar Suite
CVE-2023-47728

IBM QRadar Suite Software information disclosure

IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the request. This information could be used in further attacks against the system. IBM X-Force ID: 272201.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Pak For Security Qradar Suite
CVE-2022-43915

IBM App Connect Enterprise Certified Container

IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, and 12.1 does not limit calls to unshare in running Pods. This can allow a user with privileged access to execute commands in a running Pod to elevate their user privileges.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise Certified Container
CVE-2022-38382

IBM Cloud Pak for Security session fixation

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information. IBM X-Force ID: 233672.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Cloud Pak For Security Qradar Suite
CVE-2024-43180

IBM Concert information disclosure

IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Concert
CVE-2024-38315

IBM Aspera Shares session fixation

IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aspera Shares
CVE-2024-35118

IBM MaaS360 information disclosure

IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Maas360 Maas360 Mdm
CVE-2024-35143

IBM Planning Analytics Local missing authentication

IBM Planning Analytics Local 2.0 and 2.1 connects to a MongoDB server. MongoDB, a document-oriented database system, is listening on the remote port, and it is configured to allow connections without password authentication. A remote attacker can gain unauthorized access to the database. IBM X-Force ID: 292420.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Planning Analytics Local Planning Analytics Workspace
CVE-2023-50315

IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274714.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2022-33162

IBM Directory Server buffer overflow

IBM Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources, at the privilege level of a standard unprivileged user. IBM X-Force ID: 228570.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Directory Integrator Security Verify Directory Security Verify Directory Integrator
CVE-2024-45074

IBM webMethods Integration directory traversal

IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Softwareag
Products
Webmethods Integration Webmethods