IBM CVEs
6,555 CVEs and advisories name IBM as an affected vendor, 7 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-5000IBM Financial Transaction Manager 3.2.0 through 3.2.8 is vulnerable to cross-site scripting.
- CVE-2021-29754IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inboun
- CVE-2021-20396IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another us
- CVE-2020-5003IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.
- CVE-2021-20517IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories.
- CVE-2020-5008IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters.
- CVE-2021-20380IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain sensitive information
- CVE-2021-29670IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
- CVE-2021-29668IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
- CVE-2021-20371IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is retu
- CVE-2021-20348IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
- CVE-2021-20347IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
- CVE-2021-20346IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
- CVE-2021-20345IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
- CVE-2021-20343IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
- CVE-2021-20338IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
- CVE-2020-5030IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
- CVE-2020-4977IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting.
- CVE-2020-4732IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security r
- CVE-2020-4495IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access co
- CVE-2021-29740IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerabili
- CVE-2020-4561IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions.
- CVE-2020-4520IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim
- CVE-2020-4354IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting.
- CVE-2020-4300IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.
- CVE-2019-4730IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.
- CVE-2019-4724IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete sett
- CVE-2019-4723IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete sett
- CVE-2019-4722IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information via a stack trace due to mishandling of cer
- CVE-2019-4653IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting.