IBM CVEs
6,555 CVEs and advisories name IBM as an affected vendor, 7 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2016-9991IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious
- CVE-2016-9736IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information.
- CVE-2016-9698IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processi
- CVE-2016-8987IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access
- CVE-2016-6098IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resour
- CVE-2016-6093IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to
- CVE-2017-1305IBM DOORS Next Generation (DNG/RRC) 6.0.2 and 6.0.3 is vulnerable to cross-site scripting.
- CVE-2017-1196IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier
- CVE-2017-1178IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting.
- CVE-2017-1125IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents
- CVE-2016-9977IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate
- CVE-2016-9710IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files.
- CVE-2016-8939IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner
- CVE-2016-6089IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to
- CVE-2016-6087IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key E
- CVE-2016-5960IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores user credentials in plain in clear text which can be read by a local user.
- CVE-2016-5959IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters.
- CVE-2016-3051IBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some privileged functionality of the server.
- CVE-2016-3019IBM Security Access Manager for Web 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly
- CVE-2016-0254IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error
- CVE-2017-1325IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting.
- CVE-2017-1292IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attac
- CVE-2017-1291IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks.
- CVE-2017-1320IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting.
- CVE-2017-1289IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data.
- CVE-2017-1282IBM Content Navigator & CMIS 2.0 and 3.0 is vulnerable to cross-site scripting.
- CVE-2017-1159IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.
- CVE-2017-1092IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows serv
- CVE-2016-6112IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and
- CVE-2016-9750IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user.