IBM Application Gateway vulnerabilities

7 vulnerabilities

Known vulnerabilities in IBM Application Gateway, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2021-20576ibmapplication_gateway+1
EPSS score
2.48%
IBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP GET request that could cause the application to crash.4CVE-2021-20575ibmapplication_gateway+1
EPSS score
0.27%
IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278.5.4CVE-2025-36397ibmapplication_gateway
EPSS score
0.20%
IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.5.4CVE-2025-36396ibmapplication_gateway
EPSS score
0.18%
IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.5.4CVE-2022-22387ibmapplication_gateway
EPSS score
0.47%
IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 221965.5.5CVE-2024-45655ibmapplication_gateway
EPSS score
0.13%
IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.10CVE-2024-28787ibmapplication_gateway+3
EPSS score
0.81%
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote attacker to obtain highly sensitive private information or cause a denial of service using a specially crafted HTTP request. IBM X-Force ID: 286584.