Vulnerabilidades do Ibm I

CVE-2026-96119 Crítica · 9.9 CWE-94 12/10/2026

Injeção de código no GUI de administração do HTTP Server do IBM i

O IBM i 7.3, 7.4, 7.5 e 7.6 pode permitir que um atacante remoto autenticado obtenha informações sensíveis ou execute código arbitrário no sistema devido à sanitização imprópria de dados pela aplicação web HTTP Server Administration.

CVE-2026-93886 Média · 5.4 CWE-79 12/10/2026

IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

CVE-2026-81858 Alta · 8.1 CWE-125 12/10/2026

IBM i is Affected By A Denial of Service Vulnerability in Host Servers

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

CVE-2026-18343 Média · 4.4 CWE-269 12/10/2026

IBM i is Affected By An Improper Privilege Management Vulnerability

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

CVE-2026-18318 Média · 5.3 CWE-307 12/10/2026

IBM i Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

CVE-2026-17487 Média · 5.3 CWE-200 12/10/2026

IBM i is Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.

CVE-2026-17484 Média · 5.5 CWE-200 12/10/2026

IBM i is Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.

CVE-2026-10852 Alta · 7.5 CWE-476 22/06/2026

Websphere Application Server is Affected By a Denial of Service

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer Plug-in component when an attacker can pass crafted requests to the web server.

CVE-2026-9072 Crítica · 9.8 CWE-94 22/06/2026

IBM WebSphere WebServer Plug-in: injeção de código e negação de serviço

IBM WebSphere Application Server e IBM WebSphere Application Server Liberty - quando usados com Intelligent Management e o componente WebSphere WebServer Plug-in - são vulneráveis a execução remota de código e negação de serviço. Essa vulnerabilidade pode ser explorada quando um atacante se faz passar por servidores backend e envia respostas forjadas ao plug-in.

CVE-2026-8858 Alta · 8.8 CWE-94 22/06/2026

WebSphere Application Server Remote Code Execution

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

CVE-2026-7870 Alta · 8.8 CWE-427 11/06/2026

IBM i is Affected by Privilege Escalation []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.

CVE-2026-6936 Média · 6.5 CWE-674 27/05/2026

IBM i is Affected by a Denial of Service Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a denial-of-service attack due to uncontrolled recursion in the Integrated Language Environment (ILE) compiler. An authenticated attacker could exploit this vulnerability by compiling specially crafted source code containing a specific combination of statements.

CVE-2026-2311 Crítica · 9.8 CWE-284 30/04/2026

IBM i is affected by a privilege escalation vulnerability in Web Administration GUI []

IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check. A malicious actor could cause user-controlled code to run with administrator privilege.

CVE-2026-1376 Alta · 7.5 CWE-770 17/03/2026

IBM i Denial of Service

IBM i 7.6 could allow a remote attacker to cause a denial of service using failed authentication connections due to improper allocation of resources.

CVE-2025-36371 Média · 6.5 CWE-598 19/11/2025

IBM i Information Disclosure

IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 are impacted by obtaining an information vulnerability in the database plan cache implementation. A user with access to the database plan cache could see information they do not have authority to view.

CVE-2025-36367 Alta · 8.8 CWE-862 01/11/2025

IBM i is affected by a privilege escalation in IBM i SQL services

IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use the elevated privileges of another user profile to gain root access to the host operating system.