Vulnerabilidades de Ibm
CVEs publicadas que afetam produtos de Ibm: 1629 registro(s), com severidade, exploração e correções.
I 163Aix 159Vios 156PowerVM VIOS 145Langflow OSS 143Guardium Data Protection 91Websphere Application Server 89Db2 69Security Verify Access 63Verify Identity Access 63Concert 62Verify Identity Access Container 59Security Verify Access Container 58Datastage On Cloud Pak For Data 58WebSphere Application Server - Liberty 47Financial Transaction Manager (FTM) for RedHat OpenShift 47Financial Transaction Manager 46DataPower Gateway 10.6.0 43Datapower Gateway 43DataPower Gateway 10.5.0 42DataPower Gateway 10.6CD 41DataPower Gateway 11.0.0 41Power System E1180 (9080-heu) Firmware 36Power System E1080 (9080-hex) Firmware 35Power System S1022 (9105-22a) Firmware 32Power System S1012 (9028-21b) Firmware 32Power System L1122 (9856-22h) Firmware 32Power System S1024 (9105-42a) Firmware 32Power System S1014 (9105-41b) Firmware 32Power System S1114 (9824-41b) Firmware 32Power System L1022 (9786-22h) Firmware 32Power System L1124 (9856-42h) Firmware 32Power System S1022s (9105-22b) Firmware 32Power System E1150 (9043-mru) Firmware 32Power System L1024 (9786-42h) Firmware 32Power System E1050 (9043-mrx) Firmware 32Power System S1122 (9824-22a) Firmware 32Power System S1124 (9824-42a) Firmware 32Power System S1122s (9824-22b) Firmware 32Power System S914 (9009-41g) Firmware 28
CVE-2026-14519
Alta · 7.5
CWE-22 30/07/2026
IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability.
CVE-2026-12947
Alta · 7.5
CWE-532 30/07/2026
IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user.
CVE-2026-11980
Alta · 7.3
CWE-242 30/07/2026
Code execution in IBM Desktop App
IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.
CVE-2026-11897
Alta · 7.5
CWE-770 30/07/2026
IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-11707
Crítica · 9.3
CWE-79 30/07/2026
Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.
CVE-2026-11383
Média · 5.4
CWE-79 30/07/2026
Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.
CVE-2025-36431
Média · 5.4
CWE-79 30/07/2026
XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-36298
Média · 5.4
CWE-79 30/07/2026
Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 Ebics server component is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2026-2482
Alta · 8.8
CWE-352 29/07/2026
IBM WebSphere Application Server Liberty is affected by a cross-site request forgery
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVE-2026-14529
Crítica · 9.8
CWE-306 29/07/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.
CVE-2026-15328
Alta · 8.1
CWE-444 28/07/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.
CVE-2026-15325
Alta · 8.7
CWE-444 28/07/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.
CVE-2026-15280
Alta · 7.5
CWE-22 28/07/2026
IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.
CVE-2026-15064
Alta · 8.7
CWE-444 28/07/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
CVE-2026-15057
Alta · 7.5
CWE-787 28/07/2026
IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.
CVE-2026-14996
Alta · 8.2
CWE-613 28/07/2026
Multiple vulnerabilities in IBM Aspera Faspex
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
CVE-2026-14981
Alta · 7.5
CWE-400 28/07/2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
CVE-2026-14976
Crítica · 9.8
CWE-306 28/07/2026
IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
CVE-2026-14974
Crítica · 9.8
CWE-502 28/07/2026
IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.
CVE-2026-14973
Crítica · 9.3
CWE-22 28/07/2026
Path Traversal in IBM Desktop App
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.
CVE-2026-14959
Alta · 7.2
CWE-78 28/07/2026
OS Command Injection in IBM Aspera Faspex
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.
CVE-2026-14958
Alta · 7.2
CWE-78 28/07/2026
OS command injection in IBM Aspera Faspex
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
CVE-2026-14893
Alta · 7.3
CWE-1321 28/07/2026
IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.
CVE-2026-14528
Alta · 7.5
CWE-532 28/07/2026
IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information
IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.
CVE-2026-14515
Média · 6.1
CWE-79 28/07/2026
IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.