CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

IBM : Security Vulnerabilities (CVSS score between 6 and 6.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2022-22476 290 2022-07-08 2022-08-03
6.0
 None Remote Medium ??? Partial Partial Partial
IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604.
2 CVE-2022-22463 89 Sql 2022-07-08 2022-07-16
6.4
 None Remote Low Not required Partial Partial None
IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 225079.
3 CVE-2022-22410 +Info 2022-04-06 2022-04-15
6.5
 None Remote Low ??? Partial Partial Partial
IBM Watson Query with Cloud Pak for Data as a Service could allow an authenticated user to obtain sensitive information that would allow them to examine or alter system configurations or data sources connected to the service. IBM X-Force ID: 222763.
4 CVE-2022-22392 434 Exec Code 2022-04-25 2022-05-05
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in code execution. IBM X-Force ID: 222066.
5 CVE-2022-22346 352 CSRF 2022-03-14 2022-03-22
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220048.
6 CVE-2022-22339 918 2022-04-08 2022-04-15
6.5
 None Remote Low ??? Partial Partial Partial
IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 219736.
7 CVE-2022-22315 269 2022-04-27 2022-05-05
6.0
 None Remote Medium ??? Partial Partial Partial
IBM UrbanCode Deploy (UCD) 7.2.2.1 could allow an authenticated user with special permissions to obtain elevated privileges due to improper handling of permissions. IBM X-Force ID: 217955.
8 CVE-2022-22308 77 2022-02-21 2022-03-01
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application could be tricked into including remote files with malicious code. IBM X-Force ID: 216891.
9 CVE-2021-39080 2022-02-14 2022-02-23
6.4
 None Remote Low Not required Partial Partial None
Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could be able to reverse engineer the codebase to gain knowledge about the programming technique, interface, class definitions, algorithms and functions used. IBM X-Force ID: 215593.
10 CVE-2021-39070 2022-02-02 2022-07-12
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Security Verify Access 10.0.0.0, 10.0.1.0 and 10.0.2.0 with the advanced access control authentication service enabled could allow an attacker to authenticate as any user on the system. IBM X-Force ID: 215353.
11 CVE-2021-39066 384 2022-02-02 2022-02-05
6.5
 None Remote Low ??? Partial Partial Partial
IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated sessions. IBM X-Force ID: 215040.
12 CVE-2021-39051 918 2022-03-14 2022-03-22
6.4
 None Remote Low Not required Partial Partial None
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server registration form in the portal UI to enumerate and attack services that are running on those hosts. IBM X-Force ID: 214441.
13 CVE-2021-39044 352 CSRF 2022-02-02 2022-02-05
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 214210.
14 CVE-2021-39040 434 2022-04-25 2022-05-03
6.0
 None Remote Medium ??? Partial Partial Partial
IBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not validating the file types or sizes. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 214025.
15 CVE-2021-39031 74 2022-01-25 2022-01-28
6.5
 None Remote Low ??? Partial Partial Partial
IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM X-Force ID: 213875.
16 CVE-2021-39022 1236 2022-03-10 2022-03-22
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software. IBM X-Force ID: 213858.
17 CVE-2021-38937 2021-12-10 2021-12-14
6.8
 None Remote Low ??? None None Complete
IBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the system to crash using a specially crafted IBMi Hypervisor call. IBM X-Force ID: 210894.
18 CVE-2021-38886 352 CSRF 2022-04-22 2022-06-03
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399.
19 CVE-2021-29845 20 2022-01-26 2022-02-02
6.5
 None Remote Low ??? Partial Partial Partial
IBM Security Guardium Insights 3.0 could allow an authenticated user to perform unauthorized actions due to improper input validation. IBM X-Force ID: 205255.
20 CVE-2021-29844 918 2021-10-27 2021-11-02
6.5
 None Remote Low ??? Partial Partial Partial
IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
21 CVE-2021-29837 352 CSRF 2021-10-06 2021-10-14
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 204913.
22 CVE-2021-29792 269 +Priv 2021-07-12 2021-07-14
6.5
 None Remote Low ??? Partial Partial Partial
IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain privileges of another user. IBM X-Force ID: 203450.
23 CVE-2021-29780 20 2021-07-19 2021-07-26
6.5
 None Remote Low ??? Partial Partial Partial
IBM Resilient OnPrem v41.1 of IBM Security SOAR could allow an authenticated user to perform actions that they should not have access to due to improper input validation. IBM X-Force ID: 203085.
24 CVE-2021-29774 2021-10-27 2022-07-12
6.0
 None Remote Medium ??? Partial Partial Partial
IBM Jazz Team Server products could allow an authenticated user to obtain elevated privileges under certain configurations. IBM X-Force ID: 203025.
25 CVE-2021-29757 352 CSRF 2021-08-02 2021-08-06
6.8
 None Remote Medium Not required Partial Partial Partial
IBM QRadar User Behavior Analytics 4.1.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 202168.
26 CVE-2021-29756 352 CSRF 2021-12-03 2022-01-04
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 202167.
27 CVE-2021-29745 2021-10-15 2022-07-12
6.5
 None Remote Low ??? Partial Partial Partial
IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access to the 'New Job' page to which they should not have access to. IBM X-Force ID: 201695.
28 CVE-2021-29730 89 Sql 2021-07-09 2021-07-15
6.5
 None Remote Low ??? Partial Partial Partial
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 201164.
29 CVE-2021-29715 +Info 2021-08-26 2022-07-12
6.4
 None Remote Low Not required Partial None Partial
IBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive information or conduct denial of serivce attacks due to open ports. IBM X-Force ID: 201018.
30 CVE-2021-29679 94 Exec Code 2021-10-15 2021-11-17
6.5
 None Remote Low ??? Partial Partial Partial
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include (SSI) directive. IBM X-Force ID: 199915.
31 CVE-2021-20574 74 2021-06-28 2021-07-07
6.5
 None Remote Low ??? Partial Partial Partial
IBM Security Identity Manager Adapters 6.0 and 7.0 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and takeover other accounts. IBM X-Force ID: 199252.
32 CVE-2021-20538 863 +Info 2021-05-10 2021-05-14
6.4
 None Remote Low Not required Partial Partial None
IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms. IBM X-Force ID: 198919.
33 CVE-2021-20527 77 2021-04-19 2021-04-23
6.5
 None Remote Low ??? Partial Partial Partial
IBM Resilient SOAR V38.0 could allow a privileged user to create create malicious scripts that could be executed as another user. IBM X-Force ID: 198759.
34 CVE-2021-20517 22 Dir. Trav. 2021-06-07 2021-06-10
6.5
 None Remote Low ??? Partial Partial Partial
IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to read and delete arbitrary files on the system. IBM X-Force ID: 198435.
35 CVE-2021-20501 2021-04-21 2022-07-12
6.4
 None Remote Low Not required None Partial Partial
IBM i 7.1, 7.2, 7.3, and 7.4 SMTP allows a network attacker to send emails to non-existent local-domain recipients to the SMTP server, caused by using a non-default configuration. An attacker could exploit this vulnerability to consume unnecessary network bandwidth and disk space, and allow remote attackers to send spam email. IBM X-Force ID: 198056.
36 CVE-2021-20492 611 2021-05-26 2021-06-04
6.4
 None Remote Low Not required Partial None Partial
IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793.
37 CVE-2021-20489 352 CSRF 2021-10-07 2021-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 197790.
38 CVE-2021-20454 611 2021-04-21 2021-04-23
6.4
 None Remote Low Not required Partial None Partial
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196649.
39 CVE-2021-20453 611 2021-04-20 2022-05-03
6.4
 None Remote Low Not required Partial None Partial
IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196648.
40 CVE-2021-20423 732 2021-07-13 2021-07-14
6.5
 None Remote Low ??? Partial Partial Partial
IBM Cloud Pak for Applications 4.3 could allow an authenticated user gain escalated privilesges due to improper application permissions. IBM X-Force ID: 196308.
41 CVE-2021-20403 352 CSRF 2021-02-11 2021-02-12
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Security Verify Information Queue 1.0.6 and 1.0.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
42 CVE-2021-20378 613 2021-07-07 2021-07-09
6.5
 None Remote Low ??? Partial Partial Partial
IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 195709.
43 CVE-2021-20353 611 2021-02-10 2021-02-11
6.4
 None Remote Low Not required Partial None Partial
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 194882.
44 CVE-2021-0193 287 2022-05-12 2022-05-19
6.5
 None Remote Low ??? Partial Partial Partial
Improper authentication in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of privilege via network access.
45 CVE-2020-36531 1236 2022-06-07 2022-06-14
6.0
 None Remote Medium ??? Partial Partial Partial
A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Page. An injection leads to privilege escalation. The attack may be initiated remotely.
46 CVE-2020-36530 89 Sql 2022-06-07 2022-06-14
6.0
 None Remote Medium ??? Partial Partial Partial
A vulnerability classified as critical was found in SevOne Network Management System up to 5.7.2.22. This vulnerability affects the Alert Summary. The manipulation leads to sql injection. The attack can be initiated remotely.
47 CVE-2020-5003 611 2021-06-11 2021-06-21
6.4
 None Remote Low Not required Partial None Partial
IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192956.
48 CVE-2020-4990 89 Sql 2021-05-24 2021-05-25
6.5
 None Remote Low ??? Partial Partial Partial
IBM Security Guardium 11.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 192710.
49 CVE-2020-4974 918 2021-07-28 2021-08-04
6.5
 None Remote Low ??? Partial Partial Partial
IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 192434.
50 CVE-2020-4942 352 CSRF 2021-01-04 2021-01-06
6.8
 None Remote Medium Not required Partial Partial Partial
IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191942.
Total number of vulnerabilities : 623   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.