Filtered by vendor Ibm
Subscriptions
Total
8109 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-36113 | 1 Ibm | 2 Sterling Connect\, Sterling Connectexpress Adapter For Sterling B2b Integrator 520 | 2026-02-03 | 5.4 Medium |
| IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2025-36115 | 1 Ibm | 2 Sterling Connect\, Sterling Connectexpress Adapter For Sterling B2b Integrator 520 | 2026-02-03 | 6.3 Medium |
| IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0.00 through 5.2.0.12 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system. | ||||
| CVE-2026-22791 | 3 Ibm, Linux, Opencryptoki Project | 3 Aix, Linux, Opencryptoki | 2026-02-03 | 6.6 Medium |
| openCryptoki is a PKCS#11 library and tools for Linux and AIX. In 3.25.0 and 3.26.0, there is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation allows an attacker with local access to cause out-of-bounds writes in the host process by supplying a compressed EC public key and invoking C_WrapKey. This can lead to heap corruption, or denial-of-service. | ||||
| CVE-2025-13925 | 1 Ibm | 1 Aspera Console | 2026-01-30 | 4.9 Medium |
| IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user. | ||||
| CVE-2025-36410 | 1 Ibm | 1 Applinx | 2026-01-26 | 3.1 Low |
| IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforcement of client-side security. | ||||
| CVE-2025-36397 | 1 Ibm | 1 Application Gateway | 2026-01-26 | 5.4 Medium |
| IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. | ||||
| CVE-2025-36409 | 1 Ibm | 1 Applinx | 2026-01-26 | 5.4 Medium |
| IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2025-36408 | 1 Ibm | 1 Applinx | 2026-01-26 | 6.4 Medium |
| IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2025-36411 | 1 Ibm | 1 Applinx | 2026-01-26 | 3.5 Low |
| IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | ||||
| CVE-2025-36396 | 1 Ibm | 1 Application Gateway | 2026-01-26 | 5.4 Medium |
| IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2025-36419 | 1 Ibm | 1 Applinx | 2026-01-26 | 5.3 Medium |
| IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system. | ||||
| CVE-2025-36418 | 1 Ibm | 1 Applinx | 2026-01-26 | 7.3 High |
| IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be able to craft or modify a JSON web token in order to impersonate another user or to elevate their privileges. | ||||
| CVE-2025-1719 | 1 Ibm | 1 Concert | 2026-01-26 | 5.9 Medium |
| IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. | ||||
| CVE-2025-1722 | 1 Ibm | 1 Concert | 2026-01-26 | 5.9 Medium |
| IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. | ||||
| CVE-2025-12985 | 1 Ibm | 1 License Metric Tool | 2026-01-26 | 8.4 High |
| IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image. | ||||
| CVE-2025-36192 | 1 Ibm | 3 Ds8900f Firmware, Ds8a00, Ds8a00 Firmware | 2026-01-14 | 6.7 Medium |
| IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms. | ||||
| CVE-2025-14687 | 1 Ibm | 2 Db2, Db2 Intelligence Center | 2026-01-14 | 4.3 Medium |
| IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms. | ||||
| CVE-2025-36437 | 1 Ibm | 1 Planning Analytics Local | 2026-01-14 | 4.3 Medium |
| IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system. | ||||
| CVE-2025-2529 | 1 Ibm | 1 Terracotta | 2026-01-14 | 2.9 Low |
| Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external parties in an unfiltered/unsalted way. | ||||
| CVE-2019-4716 | 1 Ibm | 1 Planning Analytics | 2026-01-14 | 9.8 Critical |
| IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094. | ||||