Vulnerabilidades de Ibm

CVEs publicadas que afetam produtos de Ibm: 1567 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2026-1025 Média · 6.1 CWE-79 18/09/2026

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2026-11537 Média · 4.3 CWE-650 18/09/2026

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

CVE-2026-11381 Alta · 8.8 CWE-122 18/09/2026

IBM MQ for HPE NonStop is vulnerable to a denial of service issue

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures.

CVE-2026-11378 Alta · 8.8 CWE-190 18/09/2026

IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing.

CVE-2026-11375 Alta · 8.8 CWE-122 18/09/2026

IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers.

CVE-2026-10858 Crítica · 9.9 CWE-122 18/09/2026

IBM MQ for HPE NonStop is vulnerable to a denial of service attack

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages.

CVE-2026-10853 Alta · 8.8 CWE-470 18/09/2026

IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.

CVE-2026-10841 Média · 4.8 CWE-444 18/09/2026

Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling.

CVE-2026-10751 Alta · 7.5 CWE-502 18/09/2026

IBM MQ Java messaging is vulnerable to remote code execution

IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling.

CVE-2026-10747 Crítica · 10.0 CWE-122 18/09/2026

IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing

IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication.

CVE-2026-10744 Alta · 7.5 CWE-122 18/09/2026

IBM MQ for HPE NonStop is vulnerable to a issue in MQINQ request validation

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to an integer overflow in MQINQ request validation.

CVE-2026-10575 Alta · 8.8 CWE-122 18/09/2026

IBM MQ queue manager is vulnerable to remote code execution

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers.

CVE-2026-10030 Alta · 7.1 CWE-285 18/09/2026

IBM MQ Console is vulnerable to privilege escalation

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.

CVE-2026-10027 Crítica · 9.8 CWE-787 18/09/2026

IBM MQ queue manager is vulnerable to unauthenticated remote code execution

IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.

CVE-2025-36178 Média · 5.4 CWE-1284 18/09/2026

Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.

CVE-2025-36147 Média · 6.1 CWE-79 18/09/2026

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-36421 Média · 5.9 CWE-319 18/09/2026

Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

CVE-2025-36076 Média · 4.3 CWE-540 18/09/2026

IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system.

CVE-2025-36045 Média · 4.3 CWE-799 18/09/2026

TS4300 Tape Library addresses security vulnerability

IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

CVE-2025-33147 Média · 5.9 CWE-327 18/09/2026

IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.

CVE-2025-33141 Média · 6.5 CWE-497 18/09/2026

IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

CVE-2025-15399 Crítica · 10.0 CWE-352 18/09/2026

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVE-2025-14754 Alta · 8.8 CWE-78 18/09/2026

IBM Cloud Pak for Data is vulnerable to OS command injection

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

CVE-2025-14753 Alta · 7.5 CWE-22 18/09/2026

IBM Cloud Pak for Data is vulnerable to path traversal

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

CVE-2025-1350 Média · 5.3 CWE-209 18/09/2026

Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.