IBM Corporation vulnerabilities
287 vulnerabilities
Known vulnerabilities in IBM Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 84 products.
Products
50 of 84- Kenexa LMS On Cloud21 vulnerabilities
- Rational Collaborative Lifecycle Management17 vulnerabilities
- Access Manager16 vulnerabilities
- Qradar SIEM13 vulnerabilities
- Key Lifecycle Manager12 vulnerabilities
- Kenexa LCMS Premier On Cloud11 vulnerabilities
- Bigfix Inventory8 vulnerabilities
- Websphere MQ8 vulnerabilities
- Bigfix Platform7 vulnerabilities
- Urbancode Deploy7 vulnerabilities
- Infosphere Information Server6 vulnerabilities
- Jazz Reporting Service6 vulnerabilities
- Tririga Application Platform6 vulnerabilities
- AIX5 vulnerabilities
- Connections5 vulnerabilities
- Maximo Asset Management5 vulnerabilities
- Privileged Identity Manager5 vulnerabilities
- Rational Doors Next Generation5 vulnerabilities
- Rational Rhapsody Design Manager5 vulnerabilities
- Tivoli Storage Manager5 vulnerabilities
- Cloud Orchestrator4 vulnerabilities
- Cognos Business Intelligence4 vulnerabilities
- Domino4 vulnerabilities
- Integration Bus4 vulnerabilities
- Tivoli Storage Manager Extended Edition4 vulnerabilities
- Websphere Application Server4 vulnerabilities
- Websphere Portal4 vulnerabilities
- Business Process Manager Advanced3 vulnerabilities
- Cognos Analytics3 vulnerabilities
- Cognos TM13 vulnerabilities
- Identity Manager3 vulnerabilities
- Inotes3 vulnerabilities
- Marketing Platform3 vulnerabilities
- Spectrum Control Standard Select Edition3 vulnerabilities
- Tivoli Application Dependency Discovery Manager3 vulnerabilities
- Websphere Commerce Enterprise3 vulnerabilities
- Algo One2 vulnerabilities
- Appscan Source2 vulnerabilities
- Biginsights2 vulnerabilities
- Content Navigator2 vulnerabilities
- Financial Transaction Manager2 vulnerabilities
- Interact2 vulnerabilities
- Sterling B2B Integrator2 vulnerabilities
- Sterling Order Management2 vulnerabilities
- Tealeaf Customer Experience2 vulnerabilities
- Tivoli Storage Manager For Virtual Environments2 vulnerabilities
- Websphere Cast Iron Cloud Integration2 vulnerabilities
- API Connect1 vulnerabilities
- Appscan Enterprise1 vulnerabilities
- Atlas Policy Suite1 vulnerabilities
CVE-2018-9068ibm corporationsystem x imm2+43
EPSS score1.05%
The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI.CVE-2015-1976ibm corporationdirectory server+2EPSS score0.35%
IBM Security Directory Server could allow an authenticated user to execute commands into the web administration tool that would cause the tool to crash.CVE-2015-7418ibm corporationwebsphere datapower xc10 appliance+1EPSS score0.35%
IBM WebSphere eXtreme Scale and the WebSphere DataPower XC10 Appliance allow some sensitive data to linger in memory instead of being overwritten which could allow a local user with administrator privileges to obtain sensitive information.CVE-2015-7493ibm corporationinfosphere information server+1EPSS score0.30%
IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sensitive information.CVE-2015-7494ibm corporationcloud orchestrator+2EPSS score0.24%
A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.CVE-2015-5013ibm corporationaccess managerEPSS score0.30%
The IBM Security Access Manager appliance includes configuration files that contain obfuscated plaintext-passwords which authenticated users can access.CVE-2016-2981ibm corporationrational collaborative lifecycle management+1EPSS score0.33%
An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference #: 1999965.CVE-2016-2879ibm corporationqradar siem+1EPSS score0.21%
IBM QRadar 7.2 uses outdated hashing algorithms to hash certain passwords, which could allow a local user to obtain and decrypt user credentials. IBM Reference #: 1997341.CVE-2016-2992ibm corporationbiginsights+1EPSS score0.54%
IBM Infosphere BigInsights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.CVE-2016-2866ibm corporationrational collaborative lifecycle management+1EPSS score0.85%
An unspecified vulnerability in IBM Jazz Team Server may disclose some deployment information to an authenticated user.CVE-2016-2908ibm corporationaccess manager+3EPSS score3.39%
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.CVE-2016-2939ibm corporationdomino+2EPSS score0.96%
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.CVE-2016-2942ibm corporationurbancode deploy+1EPSS score0.82%
IBM UrbanCode Deploy could allow an authenticated attacker with special permissions to craft a script on the server in a way that will cause processes to run on a remote UCD agent machine.CVE-2016-2924ibm corporationbiginsights+1EPSS score0.70%
IBM Infosphere BigInsights is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.CVE-2016-2987ibm corporationrational collaborative lifecycle management+6EPSS score0.77%
An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker.CVE-2016-2941ibm corporationurbancode deploy+1EPSS score0.35%
IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could be read by a local user.CVE-2016-2930ibm corporationbigfix remote control+1EPSS score1.63%
IBM BigFix Remote Control 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication. IBM X-Force ID: 5512.CVE-2016-2880ibm corporationqradar siem+1EPSS score0.19%
IBM QRadar 7.2 stores the encryption key used to encrypt the service account password which can be obtained by a local user. IBM Reference #: 1997340.CVE-2016-0210ibm corporationsterling b2b integrator+1EPSS score1.70%
IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to obtain sensitive information. By allowing HTTP OPTIONS method, a remote attacker could send a specially-crafted query to a vulnerable server running to cause the server to disclose sensitive information in the HTTP response.CVE-2016-0371ibm corporationtivoli storage manager+1EPSS score0.34%
The Tivoli Storage Manager (TSM) password may be displayed in plain text via application trace output while application tracing is enabled.