IBM CVEs
6,555 CVEs and advisories name IBM as an affected vendor, 7 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2016-9735IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces.
- CVE-2016-5979IBM Distributed Marketing 8.6, 9.0, and 10.0 could allow a privileged authenticated user to create an instance that gets created with securi
- CVE-2017-1137IBM WebSphere Application Server 8.0 and 8.5.5 could provide weaker than expected security.
- CVE-2017-1103IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data
- CVE-2016-6037IBM Rational Team Concert (RTC) is vulnerable to HTML injection.
- CVE-2016-6035IBM Rational Quality Manager is vulnerable to cross-site scripting.
- CVE-2016-5889IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau
- CVE-2016-5888IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting.
- CVE-2016-3032IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting.
- CVE-2017-1156IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.
- CVE-2016-9692IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to External Service Interaction attack, caused by improper validation of us
- CVE-2016-9691IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) er
- CVE-2016-0255IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input.
- CVE-2016-9976IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files.
- CVE-2016-2930IBM BigFix Remote Control 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication.
- CVE-2016-0382The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captur
- CVE-2017-1194IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute
- CVE-2017-1141IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages.
- CVE-2017-1170IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session.
- CVE-2016-8962IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to comprom
- CVE-2016-8924IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate a
- CVE-2017-1274IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute
- CVE-2017-1149IBM UrbanCode Deploy (UCD) 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error wh
- CVE-2017-1122IBM Security Guardium 8.2, 9.0, and 10.0 contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary comm
- CVE-2016-9980IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting.
- CVE-2016-9979IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting.
- CVE-2016-9978IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information.
- CVE-2016-8923IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive infor
- CVE-2017-1161IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for
- CVE-2017-1160IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.0.x is vulnerable to cross-site scripting.