IBM CVEs
6,555 CVEs and advisories name IBM as an affected vendor, 7 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2013-0507IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability
- CVE-2019-4670IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper dat
- CVE-2019-4616IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies.
- CVE-2019-4613IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized a
- CVE-2020-4163IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a malicio
- CVE-2019-4675IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbo
- CVE-2019-4674IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system.
- CVE-2019-4562IBM Security Directory Server 6.4.0 stores sensitive information in URLs.
- CVE-2019-4551IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality allowing anonymous use
- CVE-2019-4550IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points.
- CVE-2019-4548IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim.
- CVE-2019-4541IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls
- CVE-2019-4540IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensit
- CVE-2019-4451IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting.
- CVE-2020-4224IBM StoredIQ 7.6.0.17 through 7.6.0.20 could disclose sensitive information to a local user due to data in certain directories not being enc
- CVE-2019-4732IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a loca
- CVE-2019-4720IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request.
- CVE-2020-4207IBM Watson IoT Message Gateway 2.0.0.x, 5.0.0.0, 5.0.0.1, and 5.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking
- CVE-2019-4707IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.
- CVE-2019-4679IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could
- CVE-2019-4639IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive
- CVE-2019-4638IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies.
- CVE-2019-4637IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resu
- CVE-2019-4636IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages.
- CVE-2019-4635IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporoper input neutralizatio
- CVE-2019-4633IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy.
- CVE-2019-4632IBM Security Secret Server 10.7 is vulnerable to cross-site scripting.
- CVE-2019-4631IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.
- CVE-2019-4620IBM MQ Appliance 8.0 and 9.0 LTS could allow a local attacker to bypass security restrictions caused by improper validation of environment v
- CVE-2019-4614IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS client connecting to a Queue Manager could cause a SIGSEGV denial of service caused by convertin