IBM CVEs
6,555 CVEs and advisories name IBM as an affected vendor, 7 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-41294IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api.
- CVE-2022-38709IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting.
- CVE-2022-36774IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client prox
- CVE-2022-22503IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim.
- CVE-2022-39168IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs.
- CVE-2022-36771IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access t
- CVE-2022-35722IBM Jazz for Service Management is vulnerable to stored cross-site scripting.
- CVE-2022-35282IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF).
- CVE-2022-22387IBM Application Gateway is vulnerable to cross-site scripting.
- CVE-2022-40748IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.
- CVE-2022-35721IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting.
- CVE-2022-34348IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.
- CVE-2022-22423IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service
- CVE-2022-40616IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or pe
- CVE-2022-40608IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by man
- CVE-2022-40234Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the
- CVE-2021-38924IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 could allow a remote attacker to obtain sensitive information when a detailed technical erro
- CVE-2022-36768IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to obtain roo
- CVE-2022-35637IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a denial of service after entering a malformed SQL stat
- CVE-2022-34356IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to obtain root priv
- CVE-2022-34336IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting.
- CVE-2022-22483IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to an information disclosure in some scenarios due to unau
- CVE-2022-22330IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag.
- CVE-2022-22329IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies.
- CVE-2022-34165IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerabl
- CVE-2022-22314IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system.
- CVE-2022-36773IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.
- CVE-2022-30614IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to a denial of service via email flooding caused by sending a specially-crafte
- CVE-2021-39045IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a local attacker to obtain information due to the autocomplete feature on passwo
- CVE-2021-39009IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user.