Vulnerabilidades de Ibm

CVEs publicadas que afetam produtos de Ibm: 1629 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2026-9071 Alta · 7.5 CWE-400 22/06/2026

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

CVE-2026-9006 Crítica · 9.1 CWE-918 22/06/2026

IBM WebSphere Application Server: SSRF no Ajax Proxy

O IBM WebSphere Application Server 9.0 e 8.5 é vulnerável a server-side request forgery (SSRF) quando o Ajax Proxy está configurado. Isso pode permitir que um atacante envie requisições não autorizadas a partir do sistema, resultando em bypass de segurança ou divulgação de informações.

CVE-2026-8858 Alta · 8.8 CWE-94 22/06/2026

WebSphere Application Server Remote Code Execution

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

CVE-2026-8646 Crítica · 9.1 CWE-444 22/06/2026

Vulnerabilidade de HTTP Request Smuggling no IBM WebSphere Application Server e Liberty

Os produtos IBM WebSphere Application Server 9.0 e 8.5 e IBM WebSphere Application Server - Liberty 17.0.0.3 até 26.0.0.6 são vulneráveis a HTTP request smuggling. Um atacante remoto poderia contrabandear uma requisição especialmente elaborada para o servidor de aplicação, permitindo ao atacante contornar controles de segurança, falsificar identidade, escalar privilégios e expor informações sensíveis.

CVE-2026-8636 Alta · 7.5 CWE-316 22/06/2026

Multiple Vulnerabilities in IBM Datacap

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database.

CVE-2026-8059 Média · 6.1 CWE-79 22/06/2026

Multiple Vulnerabilities in IBM Datacap

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2026-7664 Crítica · 9.8 CWE-287 22/06/2026

IBM Langflow OSS: autorização inadequada no endpoint MCP

IBM Langflow OSS 1.0.0 até 1.8.4 pode permitir que atacantes não autenticados acessem recursos de projetos MCP protegidos e executem operações MCP devido à aplicação inadequada de autorização no endpoint de transporte Streamable MCP.

CVE-2026-7253 Média · 6.0 CWE-89 22/06/2026

IBM Sterling File Gateway SQL Injection

IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to SQL injection. A privileged user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVE-2026-12628 Crítica · 9.1 CWE-798 22/06/2026

IBM Storage Protect Client: contorno de autenticação por credencial fixa no código

IBM Storage Protect Client 8.1.0.0 até 8.2.1.0 e IBM Storage Protect Snapshot For Windows 8.1.0.0 até 8.2.1.0 podem permitir que um invasor remoto contorne a autenticação devido ao uso de uma credencial codificada no código (hardcoded) no mecanismo de autenticação do FlashCopy Manager (FCM). A aplicação contém uma credencial estática incorporada em múltiplos caminhos de código de autenticação e não valida adequadamente as respostas de autenticação, o que pode permitir que um atacante não autenticado estabeleça uma sessão confiável e acesse serviços protegidos. Essa vulnerabilidade afeta componentes cliente em múltiplas versões e pode permitir que um atacante se passe por clientes legítimos, potencialmente levando a acesso não autorizado a recursos do sistema.

CVE-2026-11372 Média · 5.4 CWE-79 22/06/2026

IBM TRIRIGA Cross-Site Scripting Vulnerability

IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2026-10845 Alta · 7.3 CWE-287 22/06/2026

IBM WebSphere Application Server is affected by an authentication bypass vulnerability

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

CVE-2024-51454 Média · 6.1 CWE-644 22/06/2026

IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities Host Header Injection observed

IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

CVE-2023-33854 Média · 5.3 CWE-294 22/06/2026

Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data using man in the middle techniques.

CVE-2026-10561 Crítica · 10.0 CWE-94 22/06/2026

IBM Langflow OSS: injeção de código com bypass de autenticação

A IBM Langflow OSS 1.0.0 até 1.9.3 apresenta uma vulnerabilidade devido a um isolamento impróprio da execução de Python combinado com um bypass de autenticação que permite a um atacante não autenticado executar código arbitrário no sistema hospedeiro, resultando em comprometimento completo

CVE-2025-33128 Média · 5.4 CWE-79 22/06/2026

IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed

IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2024-54178 Média · 6.5 CWE-770 22/06/2026

Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to improper allocation of resources.

CVE-2025-2669 Média · 6.5 CWE-295 22/06/2026

Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and obtain sensitive information outside of their authority due to improper token validation.

CVE-2026-4870 Alta · 7.5 CWE-674 12/06/2026

Qiskit SDK is vulnerable to specific functions may recurse too deeply and overflow the available stack space, when encountering certain classical expressions.

IBM Qiskit SDK 0.43.0 through 2.5.0 could allow an attacker to trigger a segmentation fault leading to a denial of service due to uncontrolled recursion in the parser.

CVE-2026-7870 Alta · 8.8 CWE-427 11/06/2026

IBM i is Affected by Privilege Escalation []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.

CVE-2026-7787 Alta · 8.1 CWE-639 11/06/2026

Unauthenticated Session History Access via Public Flow Execution

IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.

CVE-2026-4096 Média · 6.1 CWE-644 11/06/2026

A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Injection attack due to improper handling of the Host header in HTTP requests.

IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking

CVE-2026-3341 Média · 5.4 CWE-918 11/06/2026

IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services

IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2024-45636 Média · 4.4 CWE-522 11/06/2026

IBM Security QRadar EDR Software has a vulnerability where user credentials may be stored in plain text, potentially exposing sensitive information.

IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user.

CVE-2026-9330 Alta · 8.5 CWE-502 01/06/2026

IBM WebSphere Application Server is affected by remote code execution

IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.

CVE-2026-9319 Crítica · 9.0 CWE-502 01/06/2026

IBM WebSphere Application Server is affected by a remote code execution vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.