IBM CVEs
6,555 CVEs and advisories name IBM as an affected vendor, 7 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-20506IBM Jazz Foundation Products are vulnerable to cross-site scripting.
- CVE-2021-20504IBM Jazz Foundation Products are vulnerable to cross-site scripting.
- CVE-2021-20503IBM Jazz Foundation Products are vulnerable to cross-site scripting.
- CVE-2021-20502IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.
- CVE-2021-20447IBM Jazz Foundation Products are vulnerable to cross-site scripting.
- CVE-2021-20352IBM Jazz Foundation Products are vulnerable to cross-site scripting.
- CVE-2021-20482IBM Cloud Pak for Automation 20.0.2 and 20.0.3 IF002 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML dat
- CVE-2020-4944IBM UrbanCode Deploy (UCD) 7.0.3.0, 7.0.4.0, 7.0.5.3, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2, stores keystore passwords in plain te
- CVE-2020-4884IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 stores user credentials in plain in clear text which can be read by a local user.
- CVE-2020-4848IBM UrbanCode Deploy (UCD) 6.2.7.9, 7.0.5.4, and 7.1.1.1 could allow an authenticated user to initiate a plugin or compare process resources
- CVE-2020-5015IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0 through 5.3.6.2 could allow a remote attacker to cause
- CVE-2020-4882IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from user-controlled data
- CVE-2020-4635IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames.
- CVE-2020-4891IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user
- CVE-2020-4890IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a den
- CVE-2020-4851IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user to poison log files which could impact support a
- CVE-2021-20440IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient.
- CVE-2020-4184IBM Security Guardium 11.2 performs an operation at a privilege level that is higher than the minimum level required, which creates new weak
- CVE-2020-4831IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h
- CVE-2021-20336IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting.
- CVE-2020-5025IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 db2fm is vulnerable to a buffer overflow,
- CVE-2020-5024IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated attacker to
- CVE-2020-4976IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to read and write
- CVE-2020-5016IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system.
- CVE-2020-4717A vulnerability exists in IBM SPSS Modeler Subscription Installer that allows a user with create symbolic link permission to write arbitrary
- CVE-2021-20341IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could lead to further atta
- CVE-2020-5014IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system usin
- CVE-2020-4903IBM API Connect V10 and V2018 could allow an attacker who has intercepted a registration invitation link to impersonate the registered user
- CVE-2020-4695IBM API Connect V10 is impacted by insecure communications during database replication.
- CVE-2021-20351IBM Engineering products are vulnerable to cross-site scripting.