Filtered by vendor Ibm
Subscribe
Total
8804 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-22348 | 2 Hcltech, Ibm | 2 Devops Velocity, Urbancode Velocity | 2026-07-27 | N/A | 5.3 MEDIUM |
| IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. | |||||
| CVE-2024-22347 | 2 Hcltech, Ibm | 2 Devops Velocity, Urbancode Velocity | 2026-07-27 | N/A | 5.9 MEDIUM |
| IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | |||||
| CVE-2024-22349 | 2 Hcltech, Ibm | 2 Devops Velocity, Urbancode Velocity | 2026-07-27 | N/A | 4.0 MEDIUM |
| IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system. | |||||
| CVE-2026-1343 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-07-25 | N/A | 7.2 HIGH |
| IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 allows an attacker to contact internal authentication endpoints which are protected by the Reverse Proxy. | |||||
| CVE-2026-1346 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-07-25 | N/A | 9.3 CRITICAL |
| IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a locally authenticated user to escalate their privileges to root due to execution with unnecessary privileges than required. | |||||
| CVE-2026-1342 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-07-24 | N/A | 8.5 HIGH |
| IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere. | |||||
| CVE-2025-13044 | 1 Ibm | 1 Concert | 2026-07-24 | N/A | 6.2 MEDIUM |
| IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack. | |||||
| CVE-2026-4788 | 1 Ibm | 1 Tivoli Netcool\/impact | 2026-07-24 | N/A | 8.4 HIGH |
| IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user. | |||||
| CVE-2026-9762 | 1 Ibm | 1 Db2 | 2026-07-24 | N/A | 7.8 HIGH |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. | |||||
| CVE-2026-15093 | 1 Ibm | 1 Engineering Ai Hub | 2026-07-24 | N/A | 4.3 MEDIUM |
| IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs. | |||||
| CVE-2026-15091 | 1 Ibm | 1 Engineering Ai Hub | 2026-07-24 | N/A | 9.3 CRITICAL |
| IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation. | |||||
| CVE-2026-15069 | 1 Ibm | 1 Engineering Ai Hub | 2026-07-24 | N/A | 5.4 MEDIUM |
| IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during web page generation. | |||||
| CVE-2026-15322 | 1 Ibm | 1 Engineering Ai Hub | 2026-07-24 | N/A | 7.5 HIGH |
| IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs. | |||||
| CVE-2026-7771 | 1 Ibm | 1 Db2 | 2026-07-24 | N/A | 5.5 MEDIUM |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denial of service. | |||||
| CVE-2025-36148 | 1 Ibm | 1 Financial Transaction Manager For Multiplatform | 2026-07-24 | N/A | 5.4 MEDIUM |
| IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.15 IBM Financial Transaction Manager SWIFT is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | |||||
| CVE-2025-14290 | 1 Ibm | 1 Webmethods Integration Server | 2026-07-24 | N/A | 5.4 MEDIUM |
| IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | |||||
| CVE-2025-36221 | 1 Ibm | 1 Cloud Pak For Data System - Cyclops | 2026-07-24 | N/A | 5.3 MEDIUM |
| IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication. | |||||
| CVE-2026-4051 | 1 Ibm | 1 Engineering Lifecycle Management | 2026-07-24 | N/A | 7.2 HIGH |
| IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an attacker with administrative privileges to execute remote code due to exposed method that is not properly restricted. | |||||
| CVE-2025-36126 | 1 Ibm | 2 Cognos Analytics, Cognos Transformer | 2026-07-24 | N/A | 6.4 MEDIUM |
| IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | |||||
| CVE-2026-3660 | 1 Ibm | 1 Engineering Lifecycle Management | 2026-07-24 | N/A | 9.8 CRITICAL |
| IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application. | |||||