IBM CVEs
6,555 CVEs and advisories name IBM as an affected vendor, 7 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-29875IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information due to a insecure third party domain access v
- CVE-2021-29771IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.
- CVE-2021-29738IBM InfoSphere Data Flow Designer (IBM InfoSphere Information Server 11.7 ) is vulnerable to server-side request forgery (SSRF).
- CVE-2021-29737IBM InfoSphere Data Flow Designer Engine (IBM InfoSphere Information Server 11.7 ) component has improper validation of the REST API server
- CVE-2021-29868IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration.
- CVE-2021-29844IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF).
- CVE-2021-29786IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user.
- CVE-2021-29774IBM Jazz Team Server products could allow an authenticated user to obtain elevated privileges under certain configurations.
- CVE-2021-29713IBM Jazz Team Server products are vulnerable to cross-site scripting.
- CVE-2021-29673IBM Jazz Team Server products are vulnerable to cross-site scripting.
- CVE-2021-20526IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag.
- CVE-2021-29835IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting.
- CVE-2021-29883IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization token
- CVE-2021-29873IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted
- CVE-2021-38896IBM QRadar Advisor 2.5 through 2.6.1 is vulnerable to cross-site scripting.
- CVE-2021-38911IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged us
- CVE-2021-29912IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting.
- CVE-2021-29878IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting.
- CVE-2021-29745IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access to the 'New Job' pag
- CVE-2021-29679IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-cont
- CVE-2020-4951IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive informati
- CVE-2021-38915IBM Data Risk Manager 2.0.6 stores user credentials in plain clear text which can be read by an authenticated user.
- CVE-2021-38862IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti
- CVE-2021-29906IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5 could disclose sensitive information to a local user when it
- CVE-2020-4654IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information due to improper permissi
- CVE-2021-29700IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authneticated attacker to obtain sensitive information f
- CVE-2021-20584IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access control
- CVE-2021-20571IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting.
- CVE-2021-20561IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting.
- CVE-2021-20552IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical er