Ibm vulnerabilities
Published CVEs affecting Ibm products: 1629 record(s), with severity, exploitation and fixes.
I 163Aix 159Vios 156PowerVM VIOS 145Langflow OSS 143Websphere Application Server 98Guardium Data Protection 91Db2 69Security Verify Access 63Verify Identity Access 63Concert 62Verify Identity Access Container 59Security Verify Access Container 58Datastage On Cloud Pak For Data 58WebSphere Application Server - Liberty 54Financial Transaction Manager (FTM) for RedHat OpenShift 47Financial Transaction Manager 46Datapower Gateway 43DataPower Gateway 10.6.0 43DataPower Gateway 10.5.0 42DataPower Gateway 11.0.0 41DataPower Gateway 10.6CD 41Power System E1180 (9080-heu) Firmware 36Power System E1080 (9080-hex) Firmware 35Power System L1124 (9856-42h) Firmware 32Power System E1150 (9043-mru) Firmware 32Power System S1024 (9105-42a) Firmware 32Power System S1022 (9105-22a) Firmware 32Power System S1022s (9105-22b) Firmware 32Power System E1050 (9043-mrx) Firmware 32Power System S1114 (9824-41b) Firmware 32Power System L1122 (9856-22h) Firmware 32Power System S1014 (9105-41b) Firmware 32Power System L1024 (9786-42h) Firmware 32Power System S1012 (9028-21b) Firmware 32Power System L1022 (9786-22h) Firmware 32Power System S1122 (9824-22a) Firmware 32Power System S1124 (9824-42a) Firmware 32Power System S1122s (9824-22b) Firmware 32Power System S922 (9009-22g) Firmware 28
CVE-2025-12708
Medium · 5.5
CWE-798 Mar 25, 2026
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 2.2.0 contains hard-coded credentials that could be obtained by a local user.
CVE-2026-1276
Medium · 5.4
CWE-79 Mar 19, 2026
IBM QRadar SIEM Cross-Site Scripting
IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-36051
Medium · 5.5
CWE-538 Mar 19, 2026
IBM QRadar SIEM Information Disclosure
IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 stores potentially sensitive information in configuration files that could be read by a local user.
CVE-2025-15051
Medium · 5.4
CWE-79 Mar 19, 2026
IBM QRadar SIEM Cross-Site Scripting
IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality.
CVE-2025-13995
Medium · 5.0
CWE-1286 Mar 19, 2026
IBM QRadar SIEM Information Disclosure
IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could allow an attacker with access to one tenant to access hostname data from another tenant's account.
CVE-2026-3856
Critical · 9.1
CWE-353 Mar 17, 2026
IBM Db2 Recovery Expert Missing Integrity Check
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 could allow an attacker to modify or corrupt data due to an insecure mechanism used for verifying the integrity of the data during transmission.
CVE-2026-1264
Medium · 6.5
CWE-306 Mar 17, 2026
IBM Sterling B2B Integrator and IBM Sterling File Gateway Improper Access Controls
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 allows a remote unauthenticated attacker to view and delete the partners of a community and to delete the communities.
CVE-2025-14031
High · 7.5
CWE-77 Mar 17, 2026
IBM Sterling B2B Integrator and IBM Sterling File Gateway Denial of Service
IBM Sterling B2B Integrator and and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 could allow an unauthenticated attacker to send a specially crafted request that causes the application to crash.
CVE-2026-1376
High · 7.5
CWE-770 Mar 17, 2026
IBM i Denial of Service
IBM i 7.6 could allow a remote attacker to cause a denial of service using failed authentication connections due to improper allocation of resources.
CVE-2026-1267
Medium · 6.5
CWE-200 Mar 17, 2026
IBM Planning Analytics Information Disclosure
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls.
CVE-2025-14806
Medium · 5.7
CWE-524 Mar 17, 2026
IBM Planning Analytics Information Disclosure
IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.
CVE-2026-0977
High · 7.1
CWE-284 Mar 16, 2026
IBM CICS Transaction Gateway for Multiplatforms Information Disclosure
IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls.
CVE-2025-13460
Medium · 5.3
CWE-204 Mar 16, 2026
IBM Aspera Console Information Disclosure
IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy.
CVE-2025-13459
Medium · 4.9
CWE-841 Mar 16, 2026
IBM Aspera Console Denial of Service
IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.
CVE-2025-13212
Medium · 4.3
CWE-799 Mar 16, 2026
IBM Aspera Console Denial of Service
IBM Aspera Console 3.3.0 through 3.4.8 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
CVE-2026-0835
Medium · 5.4
CWE-79 Mar 13, 2026
Cross-site Scripting (XSS) in Ibm Sterling B2b Integrator
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-36368
High · 7.2
CWE-89 Mar 13, 2026
IBM Sterling B2B Integrator and IBM Sterling File Gateway SQL Injection
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2025-14811
Medium · 5.9
CWE-598 Mar 13, 2026
IBM Sterling Partner Engagement Manager Information Disclosure
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.
CVE-2025-14504
Medium · 5.4
CWE-79 Mar 13, 2026
IBM Sterling B2B Integrator and IBM Sterling File Gateway Cross-Site Scripting
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-14483
Medium · 6.5
CWE-201 Mar 13, 2026
IBM Sterling B2B Integrator and IBM Sterling File Gateway Information Disclosure
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1, and 6.2.2.0 could disclose sensitive host information to authenticated users in responses that could be used in further attacks against the system.
CVE-2025-13726
High · 7.5
CWE-209 Mar 13, 2026
IBM Sterling Partner Engagement Manager Information Disclosure
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.
CVE-2025-13723
High · 7.5
CWE-324 Mar 13, 2026
IBM Sterling Partner Engagement Manager Information Disclosure
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token
CVE-2025-13718
High · 7.5
CWE-319 Mar 13, 2026
IBM Sterling Partner Engagement Manager Information Disclosure
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.
CVE-2025-13702
Medium · 5.4
CWE-79 Mar 13, 2026
IBM Sterling Partner Engagement Manager Cross-Site Scripting
IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2023-40693
Medium · 5.4
CWE-79 Mar 13, 2026
IBM Sterling B2B Integrator and IBM Sterling File Gateway Cross-Site Scripting
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, and 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.