IBM
Monthly
Information disclosure in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows a remote authenticated attacker with only low-level privileges to obtain sensitive information, because authorization checks are not properly enforced on certain resources. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network reachability and low attack complexity but also that a valid account is a prerequisite, so unauthenticated external attackers cannot exploit it directly; there is no integrity or availability impact. At time of analysis there is no public exploit identified, and the primary risk is for multi-tenant or publicly registrable Langflow deployments where obtaining a low-privileged account is trivial. IBM has published a vendor advisory covering this issue.
Low-privileged authenticated users of IBM Langflow OSS 1.0.0 through 1.12.2 can retrieve credentials that the platform fails to protect adequately, exposing stored secrets such as integration keys and API tokens to any account holder on the instance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) confirms a network-reachable flaw requiring only low privileges and no user interaction, with a scope change and high confidentiality impact but no integrity or availability effect. Exploitation requires a valid authenticated session, which rules out anonymous internet attacks; no public exploit has been identified at time of analysis and IBM has published fixes via its support advisory, so the highest residual risk sits in multi-user or multi-tenant deployments where low-trust accounts coexist with high-value stored credentials.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 lets a remote attacker who already holds a valid low-privilege account or session reach files outside the intended restricted directory, exposing sensitive information hosted on or reachable from the Langflow instance (CWE-22). The flaw is network-reachable with low attack complexity and no user interaction required, but it is explicitly not unauthenticated - an attacker must first be able to log in, so internet-exposed deployments with self-service registration or shared credentials carry the greatest realistic risk. At the time of analysis no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV); IBM has published a fix through its support advisory.
Authenticated attackers holding low-privileged credentials on an IBM Financial Transaction Manager (FTM) 4.x for Red Hat OpenShift deployment can exploit an XML external entity (XXE) injection flaw to disclose sensitive files and internal resources readable by the application, rated CVSS 3.1 base 6.5 (MEDIUM) with high confidentiality impact and no integrity or availability effect. Exploitation requires network reachability to an FTM endpoint that parses attacker-supplied XML with external-entity resolution enabled, plus valid credentials (PR:L) and no user interaction; because FTM is typically deployed as an internal back-office payments/financial processing system rather than an internet-facing service, exposure is usually limited to authenticated users and adjacent network positions. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and IBM has published an advisory for the affected versions.
Authenticated path traversal in the Universal Connector Oracle Wallet upload component of IBM Guardium Data Protection 12.2 lets a low-privilege remote user write files to arbitrary filesystem locations on the appliance. The attacker must already hold a valid account with access to the Universal Connector upload function (PR:L) and must craft a traversal sequence that lands a file somewhere useful, which is why the vector carries AC:H despite the high confidentiality and integrity impact. Exploitation has not been observed: CISA SSVC records Exploitation as none and there is no public exploit identified at time of analysis, so this is a genuine but moderate-priority issue rather than a widespread emergency - though the 'total' technical impact rating means a successful hit against a misconfigured deployment could be severe.
Authenticated SQL injection in the PESI service of IBM Guardium Data Protection 12.2 allows a logged-in attacker with network reachability to the service to inject SQL through a parameter and read sensitive records from the product's internal database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability effects, and the prerequisite is a valid Guardium session - there is no pre-authentication path. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; IBM has published a vendor advisory covering the fix, making this a genuine but conditional priority that is most urgent for internet- or broadly reachable PESI deployments with many low-privilege accounts.
In the Linux kernel, the following vulnerability has been resolved: s390/pai: Support CPU hotplug for PMU PAI The command 'perf stat -e pai_crypto/CRYPTO_ALL/ -- <command>' crashes the kernel when CPUs are hotplug added during that run. Root cause is the missing allocation of per-CPU data structures for that new CPU. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands # echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online Currently without a CPU hotplug handler, that new CPU has no per-CPU data infrastructure. The scheduler runs PMU call back function pai_add() to install the PMU support for that CPU before the task is being scheduled on that new CPU. In pai_add() instructions mp = this_cpu_ptr(pai_root[idx].mapptr); cpump = mp->mapptr; return a NULL pointer and the result is a kernel panic as variable cpump is used inside that function. Add CPU hotplug support for CPU add and delete and create the necessary per-CPU data infrastructure during CPU hotplug add processing. Same for CPU hotplug remove. This is done when the CPU is offline to ensure the data structures are available when CPU is made online and tasks are scheduled on it. [hca@linux.ibm.com: fixup error path in pai_init()]
In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: mal: fix potential system hang in mal_remove() napi_disable() is not idempotent and calling it on an already-disabled or unenabled NAPI context will cause the kernel to spin indefinitely waiting for the NAPI_STATE_SCHED bit to clear. In mal_remove(), napi_disable() is called unconditionally. If no MACs were registered, NAPI was never enabled. Also, if they were registered but subsequently unregistered, NAPI was already disabled in mal_unregister_commac(). In either case, calling napi_disable() causes the kernel to hang upon module removal. Fix this by only calling napi_disable() in mal_remove() if the commac list is not empty (which implies NAPI is enabled).
An authenticated administrator can read files outside the configured log directory in IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 by abusing a prefix-only path check on the Admin API log-download endpoint GET /v1/admin/logs/file. Because the confinement test uses str.startswith(), a crafted filename that resolves into a sibling directory sharing the LOG_FOLDER string prefix is accepted, exposing .log, .jsonl and .json files - but not arbitrary filesystem content, since only those extensions and prefix-adjacent paths are reachable. Exploitation requires a high-privileged (PR:H) admin account, and no public exploit identified at time of analysis; the C:H confidentiality rating overstates practical risk given the admin prerequisite and the narrow set of reachable files.
IBM Concert 1.0.0 through 3.0.0 contains a local information disclosure flaw in its recursive directory-copy functionality, where a lack of proper access controls can lead to the unintentional inclusion of sensitive or unnecessary files, increasing the attack surface. The vulnerability requires local access to the host and is modeled as unauthenticated (PR:N) with no user interaction (UI:N), but its impact is bounded to confidentiality loss (C:H) with no integrity or availability impact. No public exploit code has been identified, and the vendor has released a patch via IBM support.
Hypervisor memory disclosure in IBM PowerVM firmware (FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81) allows an attacker who already holds root inside a guest partition to read a limited, non-attacker-controlled portion of uninitialized hypervisor memory through a hypervisor call interface, potentially exposing sensitive data belonging to the hypervisor or to co-resident guest partitions. According to the assessed CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), exploitation requires local access and high privileges (root in a guest) and yields only a confidentiality impact of low severity, with no integrity or availability effect and no attacker control over which memory contents are returned. There is no public exploit code identified and no confirmed active exploitation (not listed in CISA KEV); the practical risk is concentrated in multi-tenant environments where untrusted parties run arbitrary guest OS images on shared Power hardware, while single-tenant systems face little exposure.
A limited out-of-bounds memory read in the host-facing BMC firmware management service of IBM OpenBMC can be triggered by a host system to crash that service and read a small amount of BMC internal memory, producing low confidentiality and availability impact (CVSS 3.4). Only agents who already hold high-privileged control of the managed host can reach the vulnerable interface, since the flaw sits on the local host-to-BMC path (AV:L, PR:H) rather than on the network. Affected firmware levels are FW1060.00 through FW1060.81, FW1110.00 through FW1110.31, and FW1120.00 through FW1120.01; there is no public exploit code identified and no confirmed active exploitation (not in CISA KEV), so the practical risk is low and is largely contingent on the host already being compromised at a privileged level.
Local users with only low-level privileges on IBM i systems running Db2 Mirror for i 7.4, 7.5, or 7.6 can obtain partial sensitive information because the product encrypts data using AES in Electronic Codebook (ECB) mode, a deterministic cipher mode that leaks patterns in the underlying plaintext. The exposure is limited to confidentiality (C:L) with no integrity or availability impact, and exploitation requires local access plus the ability to observe data produced by the affected encryption code path, giving a low overall severity of 3.3. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS probability was supplied, consistent with a low-priority informational-disclosure weakness.
Improper handling of sensitive data in the IBM PowerVM Hypervisor partition resource dump interface allows an authenticated administrator on the Hardware Management Console (HMC) or the Power service processor to obtain a limited snapshot of partition processor state, resulting in a confidentiality exposure on the managed system. Affected firmware spans the FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81 and FW950.00-FW950.H3 branches. Exploitation requires administrator-level credentials and adjacent-network reachability to the management plane (CVSS 3.1 base score 3.4, vector AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N); there is no public exploit identified at time of analysis, and the practical risk is low because the prerequisite privileged management access is itself a strong barrier and the disclosure is limited in scope.
Local root access inside a guest logical partition (LPAR) on IBM PowerVM systems running affected partition firmware allows an attacker to send a crafted request to the partition firmware runtime and crash it, with possible memory corruption. Rated CVSS 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), the flaw affects firmware lines FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81 and FW950.00 through FW950.H3; no public exploit has been identified at time of analysis, and the realistic outcome is denial of service to the partition firmware runtime rather than confirmed cross-partition code execution. The guest-root prerequisite makes this a bounded, low-priority risk relevant mainly to multi-tenant or compromised LPARs on shared Power hardware.
Root-level attackers inside an IBM PowerVM logical partition can corrupt the partition firmware runtime boot configuration stored in NVRAM, leaving that partition unable to boot until an operator manually deletes and recreates the partition configuration. The issue affects PowerVM firmware levels FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3, and requires pre-existing root privileges within the target partition (CVSS 3.1 AV:L/PR:H, base score 5.1) with no remote or unauthenticated path to exploitation. There is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-compromise sabotage or persistence against the attacker's own partition rather than an initial-access vector.
Denial of service in IBM PowerVM Hypervisor firmware affects logical partitions running affected FW1120, FW1110, FW1060, or FW950 levels: an attacker who already holds root inside an LPAR can send a crafted RTAS firmware-to-OS request and crash that partition, making it unavailable. The vulnerability is local-only, requires high privileges, and is contained to the attacker's partition, so other LPARs on the same managed system are not affected. No public exploit was identified at time of analysis, and the CVSS 3.1 score is 5.1 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
Limited information disclosure affects IBM PowerVM Hypervisor firmware on specific service-pack levels (FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, and FW950.00-FW950.H3), where an out-of-bounds read can expose a small amount of adjacent memory content to an attacker. Rated CVSS 4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the flaw requires no authentication or user interaction but is not reachable across the internet: the attacker must already sit on the same adjacent network segment and be able to reach a hypervisor firmware interface that processes malformed input. Impact is confined to partial confidentiality loss with no integrity or availability effect, and no public exploit identified at time of analysis; IBM has published a vendor fix advisory.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated user to read sensitive data, because namespace-wide secrets are exposed through file mounts that are reachable from the DataStage workload. The vulnerability is rated CVSS 8.8 by the vendor, but our independent assessment re-scores it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - a confidentiality-only issue with a scope change, reflecting that the exposed secrets belong to other tenants/services in the same Kubernetes/OpenShift namespace rather than to the vulnerable component itself; the source vector's claims of high integrity and availability impact are not supported by the CWE-200 description. Exploitation requires a valid authenticated account on the affected 5.4.0.0 build and no user interaction; there is no public exploit identified at time of analysis, and no EPSS or CISA KEV signal was provided. Organizations running this release should treat any credentials present in the affected namespace as potentially compromised.
Path traversal in IBM Concert 1.0.0 through 3.0.0 permits unauthenticated remote attackers to read files accessible to the Concert service account by sending crafted URLs containing dot-dot-slash sequences. The flaw has a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so impact is limited to confidentiality with no write or code execution. No public exploit code was identified at time of analysis, and IBM has made a patch available.
Improper access control in IBM Concert 1.0.0 through 3.0.0 lets a local attacker who already has access to the host modify application files that should be protected, yielding an integrity-only impact with no data disclosure or denial of service. The vendor CVSS vector is 6.2 with AV:L/PR:N, while the independent assessment rates PR:L because exploiting this flaw in practice typically requires at least a local account or a compromised co-resident process; IBM has released a vendor patch. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied. This is a genuine integrity risk but not a top-priority emergency, given the local attack vector and the product's limited deployment.
Log injection in IBM Concert 1.0.0 through 3.0.0 allows an authenticated low-privileged user to insert forged or misleading entries into application log files by supplying input that is written without neutralization of special characters such as CRLF sequences. The vulnerability is a CWE-117 improper output neutralization flaw with only a low integrity impact (C:N/I:L/A:N); it cannot be used to read data, execute code, or cause denial of service, and exploitation requires a valid low-privileged account (PR:L). No public exploit code exists and no active exploitation has been identified at time of analysis, and IBM has released a vendor patch.
IBM Guardium Data Protection 12.2 returns detailed technical error messages in the browser, allowing an authenticated administrative user to obtain sensitive information about the system. The issue is classified as CWE-209 (generation of error message containing sensitive information) with a CVSS 3.1 base score of 2.7 (Low) and a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, meaning exploitation requires a high-privileged account and yields only low confidentiality impact with no integrity or availability impact. No public exploit has been identified at time of analysis, and the vendor has published a patch advisory; the disclosed detail may be useful for follow-on attacks against the same system, but the prerequisites and limited impact make this a low-urgency issue.
IBM Concert 1.0.0 through 3.0.0 can be induced to return detailed technical error messages to a requesting browser, leaking implementation detail to a remote, unauthenticated attacker (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, C:L only, 5.3). Impact is limited to low-sensitivity information disclosure with no integrity or availability effect, so the practical value is reconnaissance for follow-on attacks, and only Concert instances whose web interface is reachable by the attacker are exposed. No public exploit identified at time of analysis, and IBM has published a vendor fix; the issue is a low-priority information-disclosure item rather than a standalone compromise vector.
Unauthenticated local invocation of the Business Rules Manager commands REST endpoint in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an actor who already has a foothold in the hosting environment exhaust resources and halt business-rule management functions. The flaw is a missing authentication check (CWE-306) in CommandsResource.java:31; the CVSS 3.1 vector (AV:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2) confirms that no credentials or user interaction are required, but also that the attack path is local and that the only impact is availability - there is no data disclosure or modification. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the local attack vector is the primary factor keeping this a low-to-moderate priority issue despite the 6.2 base score. A vendor patch is available per the IBM advisory.
Local privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an attacker who already holds a low-privileged foothold inside a running FTM container - such as a compromised service account or code execution gained through a separate flaw - elevate their privileges within that container. The issue is rated CVSS 3.1 base 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and stems from improper privilege management (CWE-250), meaning the component runs with more authority than it needs; the scope is unchanged, so the flaw by itself does not provide a path to the host node or to other containers. No public exploit identified at time of analysis, and exploitation requires local authenticated access with no remote or unauthenticated vector.
Open redirect in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated remote attacker craft a request with a manipulated Host header so that authenticated operators who follow an attacker-supplied link are bounced to an attacker-controlled site for credential phishing. The weakness resides in the PMP HostHeaderFilter (HostHeaderFilter.java:151) and is rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning there is no direct code execution, data modification, or service disruption and success depends entirely on social-engineering the operator into clicking the redirect. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SQL injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote authenticated attacker to read sensitive data from the underlying database, with impact confined to confidentiality (CVSS 6.5, C:H/I:N/A:N). The flaw is network-reachable with low attack complexity and no user interaction, but exploitation is gated behind a valid authenticated account (PR:L) on the FTM deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix; practical risk is tempered by the product's restricted financial-sector deployment footprint, making this a moderate-severity, real-but-not-urgent issue.
Unauthenticated remote attackers can clear active chat sessions in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the component handling chat sessions performs improper authorization, rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Any network-reachable deployment of the FTM chat-session feature is exposed, and exploitation requires no credentials or user interaction - but the impact is deliberately narrow: no data can be read (C:N) and the only effect is disruption of in-progress chat sessions (I:L/A:L), making this a genuinely lower-tier issue despite the MEDIUM score. No public exploit identified at time of analysis, and CISA KEV does not list this CVE.
Improper enforcement of mutual TLS client-certificate verification in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can let an unauthenticated remote attacker who already holds a position on the network path obtain sensitive information from the service. The flaw (CWE-295) is rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is remotely reachable yet constrained by high attack complexity and yields only limited confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the overall risk is genuinely low-priority despite remote reachability, and a vendor patch is available.
Authenticated remote users of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can forge entries in the transaction audit log by supplying a crafted HTTP header that the application fails to validate properly. Successful abuse requires only valid low-privilege credentials (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the practical consequence is limited to the integrity of the audit trail - no data disclosure, no service disruption, and no unauthenticated attack path. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided; combined with the narrow, specialized deployment footprint of the platform, this is a genuinely low-priority issue whose signals are consistent rather than conflicting.
Improper authorization controls in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let an authenticated, low-privilege user forge identities and act as another user across the network, bypassing the platform's security checks. Only integrity is affected - an attacker can perform unauthorized actions under a spoofed identity, but there is no exposure of confidential data and no denial-of-service impact, and a valid account on the FTM instance is a prerequisite (PR:L, so the flaw is not exploitable pre-authentication). No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; with a CVSS base of 6.5 and a narrow deployment footprint in financial transaction environments, it is a genuine but moderate-priority issue.
Resource exhaustion in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows unauthenticated attackers on an adjacent network segment to force a denial-of-service condition by driving endpoint behavior that allocates resources without limits or throttling (CWE-770). The assigned CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) confines the attack surface to callers who can already reach a vulnerable FTM endpoint from the same network segment or cluster network, and limits the outcome to availability loss - service crash or hang - with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and IBM has published a vendor advisory with remediation guidance, making this a mid-severity availability issue rather than an urgent priority.
Authenticated path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote attacker holding a valid FTM account manipulate file paths in a file-handling operation so that files are written or modified outside the intended directory. Because the flaw requires authentication and yields only limited integrity and availability impact - with no confidentiality exposure and no user interaction - it scores 5.4 and represents a medium-severity, low-priority issue rather than a high-urgency one. A vendor patch is available via IBM support node 7288641, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift ships with missing server-side authorization checks on payment-mutation functions, letting a low-privileged authenticated user invoke actions reserved for higher-privileged roles. The flaw is network-reachable and low-complexity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5 Medium), with the damage confined to integrity - unauthorized modification or execution of payment transactions - and no confidentiality or availability impact. Exploitation requires a valid FTM for Red Hat OpenShift account (PR:L) plus reachability of the affected payment endpoints; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has published a fix.
Cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to inject HTML/JavaScript that executes in the browser of a logged-in FTM operator, because HTML input is not properly neutralized (CWE-79). Exploitation requires the victim to load attacker-controlled content while holding an authenticated FTM session, so a successful attack is gated on user interaction and is confined to the victim's browser context rather than the FTM host itself. IBM has published a vendor advisory with fix guidance, no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided; the independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, a lower integrity impact than the 8.2 base score supplied with the CVE, and the deployment is narrowed by FTM's specialized financial-transaction-processing footprint on OpenShift.
Local attackers with a low-privileged account on the host or container running IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can read insufficiently protected credentials, potentially enabling lateral movement or further compromise. No public exploit was identified at time of analysis, and exploitation requires an existing local foothold-remote or unauthenticated access is not possible. Despite the MEDIUM 6.5 base score, this is a genuinely LOW-priority issue because it only affects confidentiality and benefits an attacker post-compromise.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains an XML external entity (XXE) flaw that lets an authenticated, low-privilege user who can reach an XML-accepting endpoint coerce the application's XML parser into resolving attacker-supplied external entity references, resulting in disclosure of sensitive information such as local files or internal service responses. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) the attack is network-reachable but requires a valid low-privilege account and an application code path that parses untrusted XML with external entity/DTD resolution left enabled, and our independent assessment scores the impact as confidentiality-only (C:H/I:N/A:N) rather than the vendor's mixed confidentiality/integrity rating. Exploitation is gated by authentication and by the presence of a suitable XML-processing entry point, and no public exploit identified at time of analysis; a vendor patch is available, which together keep this a mid-severity, configuration-dependent information-disclosure issue rather than an urgent priority.
An authenticated remote user of IBM Concert versions 1.0.0 through 3.0.0 can degrade or deny service availability by driving storage consumption past the limits the product is supposed to enforce. The vulnerability is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker needs a valid account and network reachability to the Concert service but no user interaction; the only impacted security property is availability, with no confidentiality or integrity loss. Exploitation requires the improperly enforced storage limits tracked as CWE-400 to be exhausted, so the practical effect is resource exhaustion leading to denial of service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and a vendor patch is published, which materially lowers the urgency of this availability-only issue.
Server-side request forgery in IBM Concert 1.0.0 through 3.0.0 allows an attacker who holds valid credentials to make the application issue HTTP requests to URLs of their choosing, which can be used to enumerate internal network services and set up follow-on attacks. The impact is bounded: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 6.5 by the vendor) reflects limited confidentiality and integrity loss rather than code execution or arbitrary file read, and exploitation requires a reachable Concert feature that dispatches server-side requests to a user-influenced URL. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (it is not in CISA KEV); IBM has published a fix via its support advisory.
Build-context directories belonging to IBM Concert 1.0.0 through 3.0.0 are recursively copied into produced container images, so any sensitive files sitting in that context (credentials, config files, keys, environment files) are baked into the image layers and disclosed to anyone who can pull the image or read its filesystem. The issue is local in nature (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 6.2): an attacker must already be able to obtain or access the built image, and no authentication or user interaction is involved, but the confidentiality impact on whatever was left in the build context is high, with no integrity or availability effect. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, so this is a genuine but low-urgency information-disclosure hygiene defect that matters most where images are pushed to shared or externally reachable registries.
Uncontrolled resource consumption in IBM Concert 1.0.0 through 3.0.0 allows a remote, unauthenticated attacker to degrade service availability by feeding a specially crafted regular expression through the affected input-processing path, causing excessive CPU and memory consumption. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N, availability impact Low only), no credentials or user interaction are required, but the practical blast radius is bounded: only availability is affected, so expect slowdowns or partial unavailability rather than data compromise or full host takeover, and only on Concert deployments that actually expose the vulnerable input surface to untrusted traffic. No public exploit code has been identified at time of analysis and there is no indication this issue is confirmed actively exploited (CISA KEV); the vendor has published a fix advisory, making this a genuine but low-priority patching item.
IBM Concert 1.0.0 through 3.0.0 uses weaker-than-expected cryptographic algorithms that can expose highly sensitive information to decryption by an attacker who obtains the protected data. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, so no authentication or user interaction is required per the vector, but exploitation is constrained by high attack complexity and the need to acquire ciphertext before breaking the weak cryptography. No public exploit identified at time of analysis and no CISA KEV entry were provided; a vendor patch is available via IBM support node 7288830.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated remote attacker inject arbitrary JavaScript into web management pages that is then executed in the browser of a user who views the injected content, because user-supplied input is not properly neutralized during page generation (CWE-79). Exploitation requires a valid low-privileged session on the appliance (CVSS vector PR:L) and, in practice, a second user - typically an operator or administrator - to render the tampered page, which is why our independent assessment scores it slightly differently from the vendor's CVSS 3.1 base of 5.9 (vendor UI:N, assessed UI:R with scope change). No public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the high attack complexity, the credential prerequisite, and the confined web-management context of a niche data-security appliance.
Server-side request forgery in the IBM i FTP server (releases 7.3, 7.4, 7.5, and 7.6) lets an authenticated FTP user bypass security restrictions and pivot to internal network services by supplying crafted PORT and EPRT commands. The flaw is an improper-validation issue (CWE-918) with a scope change because the FTP component directs connections to services outside its own security boundary; scoring is CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), so exploitation requires valid FTP credentials and network reachability of the FTP service, and impact is limited to confidentiality and integrity of whatever internal services the IBM i host can reach. Per the independent assessment this is a genuine but moderate-priority issue rather than an emergency, and no public exploit identified at time of analysis; the vendor has published a fix.
Denial of service in IBM i 7.3, 7.4, 7.5, and 7.6 allows unauthenticated attackers on an adjacent network segment to disrupt the integrated FTP server by sending authentication commands that are not properly validated. Because the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, the credential-free USER/PASS handshake is the likely trigger path, but realistic exposure is confined to LAN or same-broadcast-segment reachability rather than arbitrary internet access, and there is no confidentiality exposure or code execution evidenced. IBM has published a vendor fix, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a moderate-severity, low-real-world-priority issue.
HTTP request smuggling in IBM WebSphere Application Server and WebSphere Application Server Liberty - as bundled in IBM CICS TX Advanced per the affected CPE - lets remote attackers desynchronize request framing between a front-end intermediary and the WebSphere back end, enabling request tampering or response poisoning. Exploitation requires the server to sit behind a reverse proxy, load balancer, or CDN that parses Content-Length/Transfer-Encoding framing differently than the back end; no authentication or user interaction is needed (PR:N/UI:N), but attack complexity is high (AC:H) because the attacker must find and reliably trigger a specific parser discrepancy in the real deployed chain, and a directly exposed server with no divergent front-end parser is not smuggle-able. Impact is bounded to low confidentiality and integrity with no availability effect (CVSS 3.1 base 4.8); this is a genuine but modest-severity issue rather than a top priority, and no public exploit was identified at time of analysis.
Adjacent-network attackers can drive the Name Service component of IBM WebSphere Application Server 8.5 and 9.0 into a denial-of-service condition by supplying maliciously crafted serialized data to the CORBA/IIOP naming endpoint, which the JVM then deserializes. The flaw is unauthenticated and requires no user interaction (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.5), so the practical barrier is network position rather than credentials: the attacker must be able to reach the Name Service on the same or an adjacent network segment, and default configurations leave that service listening on the network. Impact is confined to availability - no loss of confidentiality or integrity is assessed - and no public exploit code or confirmed active exploitation has been identified at time of analysis; IBM has published a vendor fix.
HTTP request smuggling in IBM WebSphere Application Server 8.5 can allow unauthenticated remote attackers to desynchronize request processing when the server sits behind or in front of an HTTP intermediary with mismatched Content-Length parsing, potentially leading to credential theft, cache poisoning, or request hijacking. The flaw (CWE-444) rates 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) and requires a specific proxy-layer mismatch and concurrent traffic; no public exploit identified at time of analysis. Vendor patch is available and the risk is assessed as moderate and non-urgent.
Virtual host isolation bypass in IBM WebSphere Application Server and WebSphere Application Server Liberty, as bundled in IBM CICS TX Advanced 10.1, allows remote requests addressed to one configured virtual host to reach resources belonging to another virtual host on the same instance. The vendor assigns CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-284); our independent assessment keeps the same unauthenticated, low-confidentiality/low-integrity, no-availability profile but raises attack complexity to AC:H because the weakness is only meaningful when an instance is configured to serve multiple distinct virtual hosts, while a default single-virtual-host deployment offers little to bypass. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available per the IBM advisory.
HTTP request smuggling in IBM WebSphere Application Server Liberty - the runtime bundled with IBM CICS TX Advanced 10.1 - lets remote, unauthenticated attackers desynchronize HTTP message framing between an upstream HTTP parser and the Liberty backend, so a smuggled request can be processed as if it came from the trusted front-end, with low confidentiality and integrity impact on subsequent requests sharing the connection. Exploitation requires a multi-tier topology (reverse proxy, load balancer, or CDN in front of or behind Liberty) where the two parsers disagree on Content-Length/Transfer-Encoding or chunked framing, and is rated high complexity because the specific parsing gap must be discovered and precisely crafted while connection reuse must be achievable; no user interaction is required. Risk is moderate and consistent with the vendor CVSS of 4.8 (Medium); no public exploit identified at time of analysis, and patch is available from the vendor.
Missing authorization checks in the IBM WebSphere Application Server 8.5 and 9.0 administrative console allow a remote, unauthenticated attacker (per the CVSS vector PR:N) to read limited sensitive information exposed by affected console functions. The issue is rated low severity (CVSS 3.1 base 3.7, C:L/I:N/A:N) and carries a high attack complexity (AC:H), meaning the attacker must know and reach the specific console paths where checks are absent rather than sending a single trivial request. There is no public exploit identified at time of analysis, no indication of confirmed active exploitation (CISA KEV), and a vendor patch is available via IBM's advisory page.
IBM WebSphere Application Server 9.0 and 8.5 allow remote, unauthenticated attackers to obtain sensitive file-system information through the FileTransfer servlet due to incorrect authorization (CWE-863). Exploitation requires network access to the servlet endpoint, which is part of the administrative/deployment interface, and impact is limited to confidentiality (CVSS 5.3, C:L). No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available per IBM's advisory.
Unauthenticated network access to the SOAP/JMX administrative connector on IBM WebSphere Application Server 8.5 and 9.0 can bypass authentication, allowing an attacker to read limited information from the server (CWE-306, CVSS 5.3). The flaw is remotely reachable without credentials or user interaction (PR:N/UI:N/AC:L), but impact is confined to low confidentiality loss - no code execution, configuration change, or denial of service. A vendor patch is available per IBM's advisory; no public exploit has been identified at time of analysis, and real-world exposure is constrained by the fact that the SOAP/JMX connector is normally bound to a management interface that hardened deployments segment or firewall from untrusted networks.
Log injection in IBM WebSphere Application Server 9.0 and 8.5 lets remote, unauthenticated attackers corrupt server log content by supplying a crafted LTPA token cookie that the application writes to its logs without neutralizing control characters. The impact is limited to integrity (CVSS 3.1 base score 3.7, I:L) with no confidentiality or availability loss and no code execution, and exploitation is rated high complexity because the injected content must survive into the log in a form a human or downstream log consumer then misinterprets. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; a vendor patch is available per the IBM advisory.
File-system information disclosure in IBM WebSphere Application Server 9.0 and 8.5 lets an attacker positioned on an adjacent network segment query the FileTransfer servlet and learn details about the server's file system, such as file and directory names or paths. Per the vendor-supplied vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3), the flaw is rated unauthenticated and requires no user interaction, but the adjacent-network precondition means the attacker must already sit on the same management/admin LAN or WebSphere Network Deployment segment rather than reaching the service from the open Internet, and impact is limited to low-confidentiality disclosure with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; overall this is a low-priority issue, though it is notable because WebSphere is widely deployed in large enterprises.
HTTP request smuggling (CWE-444) in IBM WebSphere Application Server 8.5, 9.0, and Liberty lets an authenticated, low-privileged remote attacker desynchronize HTTP request framing between WebSphere and an intermediary so that one user's request boundaries are misattributed on a shared connection. The issue only manifests when WebSphere sits behind or in front of a second HTTP parser (reverse proxy, load balancer, or CDN) that disagrees with WebSphere on Content-Length versus Transfer-Encoding chunked handling; a standalone WebSphere instance with no fronting or backend HTTP hop is not affected, and the 4.2 score reflects high attack complexity, partial confidentiality and integrity impact, and no availability or scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available per IBM's advisory.
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2) Web UI lets an unauthenticated attacker embed arbitrary JavaScript that executes in a victim's browser session, potentially altering page behavior and exposing credentials. The vulnerability is remote and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1), meaning a user - typically an administrator or operator - must load the attacker-influenced page inside an authenticated, trusted session for the payload to fire; no attacker authentication is required. There is no CISA KEV entry and no public exploit identified at time of analysis, and a vendor patch is available, so this is a genuine but moderate-priority issue whose real-world risk depends largely on whether the licensing Web UI is exposed to untrusted or internet-facing users rather than confined to an isolated management network.
Cross-site scripting in the IBM Common Licensing Agent and ART Web UI (9.0, 9.0.0.1, 9.0.0.2) lets an unauthenticated attacker embed arbitrary JavaScript into the interface, which executes in the browser of any user who is lured into rendering the crafted content; because the script runs inside a trusted, authenticated licensing session, the realistic outcome is theft of that session's credentials or manipulation of the displayed licensing data. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) confirms no attacker authentication is needed but that exploitation depends on victim interaction, and the changed scope indicates the injected payload can affect resources beyond the vulnerable component. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the vendor has published a fix, and the primary limiting factor remains the narrow footprint of the licensing component and the requirement for a reachable Web UI plus a legitimate user to trigger the payload.
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting Tool (ART) 9.0 through 9.0.0.2 allows an authenticated low-privilege user to cause error messages to reveal environment, user, or associated data details. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (CVSS 4.3), so exploitation requires valid authentication, has low complexity, and yields only reconnaissance-grade confidentiality impact with no integrity or availability impact. No public exploit was identified at time of analysis, and this is a low-priority information-disclosure issue rather than an actively exploited flaw.
Cross-site scripting in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2 allows a user who already holds a low-privilege account on the licensing Web UI (PR:L) to embed arbitrary JavaScript that executes in another user's trusted session when that victim loads the tainted page (UI:R), potentially disclosing credentials or other session data. The flaw is rated CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and carries CWE-79; exploitation is limited to authenticated attackers and depends on a victim viewing the affected content, so it is not remotely exploitable without credentials or user interaction. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV); a patch is available from the vendor.
Cross-site scripting in IBM Common Licensing Agent 9.0 through 9.0.0.2 and ART 9.0 through 9.0.0.2 lets remote, unauthenticated attackers (CVSS PR:N) embed arbitrary JavaScript in the licensing Web UI, which executes in the browser of a victim who interacts with the crafted content (UI:R), potentially disclosing credentials or session data within a trusted session (CVSS 6.1, S:C/C:L/I:L/A:N). Only these specific Agent and ART builds are affected, and because the component is a backend licensing interface rather than a public-facing web application, opportunistic drive-by exploitation is limited; no public exploit identified at time of analysis. Successful exploitation still depends on a logged-in operator or administrator viewing attacker-influenced content, which is the primary limiting factor.
IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 send sensitive data in cleartext, allowing an attacker who occupies a man-in-the-middle position on the network path to capture confidential information. Exploitation requires an on-path adversary (e.g., via ARP or DNS spoofing or a compromised intermediary) but no authentication or user interaction; the CVSS 3.1 base score is 5.9 with high confidentiality impact but no integrity or availability impact. No public exploit code or confirmed active exploitation has been identified, and IBM has released a patch.
IBM Controller 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 permit an authenticated low-privilege user to bypass file-size validation by tampering with client-side input, producing low integrity and availability impact without confidentiality exposure. The issue is rated CVSS 5.4 and assessed as a moderate, not a priority, issue; no public exploit identified at time of analysis. A vendor patch is available per IBM advisory, and exploitation requires a valid IBM Controller account with network access.
Reflected cross-site scripting in IBM Financial Transaction Manager for SWIFT Services for Multiplatforms (versions 3.2.4.0 through 3.2.4.16) lets an unauthenticated attacker inject arbitrary JavaScript into the Web UI, which then executes in the browser of any authenticated user who loads the crafted content. Because the payload runs inside a trusted, already-authenticated session, the realistic impact is disclosure of that user's credentials or session data rather than server compromise; exploitation is constrained by the mandatory requirement that a victim interact with attacker-supplied content (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/). No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor has published remediation guidance.
IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 embed sensitive information within source code delivered to clients, allowing an authenticated user with access to that code to harvest data that can be used to mount further attacks against the system. The flaw carries a CVSS base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires a valid Cognos Analytics account, so exploitation is gated behind existing credentials or a foothold rather than being openly reachable; impact is limited to low confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the issue has not been confirmed actively exploited (CISA KEV); vendor-released remediation is available, making this a low-priority hardening item rather than an urgent threat.
Authenticated users on the IBM TS4300 tape library management interface can degrade the appliance's email notification service by triggering requests faster than it can handle, due to missing interaction-frequency (rate) controls in firmware versions 1.1.0.1 through 1.7.1.1. The impact is confined to availability of the email/alerting subsystem (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L); the data path, stored data, and integrity are unaffected, and valid credentials are a hard prerequisite. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a low-priority, patch-available hardening issue.
Information disclosure in IBM Cognos Analytics 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2 allows an unauthenticated attacker on a shared network segment to capture sensitive data because the product uses insecure network communication (CWE-327). Exploitation requires the attacker to achieve a man-in-the-middle or traffic-capture position on the same network, making it impractical over the open internet; the impact is limited to confidentiality. The vendor CVSS score of 5.9 is a fair reflection of the moderate risk, no public exploit code has been identified, and a vendor patch is available.
IBM QRadar deployments running 7.5.0 through 7.5.0 UP15 Interim Fix 006 expose sensitive backup-file contents to any holder of a valid QRadar account, because those backup files are stored with incorrect permissions. Exploitation requires authentication (CVSS vector PR:L) but no administrative rights and no user interaction, and an attacker who satisfies that bar can read configuration, credential, or event data captured in the affected backups, yielding a high confidentiality impact (C:H) with no integrity or availability effect. This is a moderate-priority information-disclosure issue rather than a high-urgency emergency: no public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and the authentication prerequisite plus the need for an unpatched interim-fix level are the principal limiting factors.
Cross-site request forgery in IBM Common Licensing Agent and ART 9.0.x allows remote attackers to execute unauthorized actions on behalf of an authenticated user, with high integrity impact but no confidentiality or availability impact. Exploitation requires the victim to visit a malicious page while authenticated to the licensing web interface; no public exploit identified at time of analysis. Vendor assigned CVSS 10.0, but independent analysis assesses a more moderate risk due to the UI:R and S:U characteristics typical of CSRF.
Authenticated command injection in IBM Cloud Pak for Data 5.1.2 lets a network-reachable, low-privileged user run arbitrary operating-system commands with elevated privileges on the underlying system. The flaw is an improper-neutralization-of-special-elements issue (CWE-78) in how user-supplied input is validated before being passed to a shell, and it rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning full loss of confidentiality, integrity and availability on the affected host once the attacker has any valid account. IBM has published a fix via its support advisory; no public exploit code has been identified at the time of analysis and there is no confirmation of active exploitation (CISA KEV).
Path traversal in IBM Cloud Pak for Data 5.1.2 lets remote, unauthenticated attackers read arbitrary files from the server filesystem by sending crafted URL requests containing ../ (dot-dot-slash) sequences. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a straightforward, low-complexity information-disclosure issue with high confidentiality impact but no integrity or availability impact; no public exploit code was identified at time of analysis. Only version 5.1.2 is named as affected, and IBM has published a vendor fix, so exposure is limited to unpatched, network-reachable deployments of that release.
Unauthenticated remote attackers can degrade the email service of IBM Sterling Partner Engagement Manager (PEM) by flooding it with requests, exploiting improper control of interaction frequency (CWE-799) so the service is unable to keep up with legitimate mail processing. The affected releases are Essentials Edition 6.3.0.0 through 6.3.0.2 and 6.2.4.0 through 6.2.4.4, plus Standard Edition 6.2.4.0 through 6.2.4.4; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium), no authentication or user interaction is required against a default configuration when the email service is network-reachable. Impact is limited to partial availability loss (A:L) with no confidentiality or integrity effect and no scope change, so this is a service-degradation weakness rather than a full application outage; no public exploit code has been identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
IBM Controller releases 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 can return detailed technical error messages to the browser, allowing remote, unauthenticated attackers to harvest implementation details about the affected system (CWE-209). Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, exploitation is network-reachable and requires no credentials or user interaction, but the impact is confined to low-value information disclosure that is most useful as reconnaissance for follow-on attacks rather than for direct compromise. No public exploit code has been identified and the issue is not listed in CISA KEV, so this is a genuine but low-priority weakness whose practical risk largely depends on whether the Controller web interface is reachable from untrusted networks.
An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath queries and read data the query engine should never return, including sensitive application records and structural details of the underlying XML documents. All shipped 24.0.x, 25.0.0 and 26.0.0 streams are affected up to and including Interim Fix 001/005/008/009 respectively, and exploitation only requires a low-privileged, network-reachable session — no user interaction and no special complexity. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-on-schedule issue rather than an emergency.
Authenticated users of IBM ContextForge MCP Gateway through v1.0.4 can bypass the gateway's payload protection mechanisms because its recursive content inspection does not fully traverse deeply nested or embedded payload structures. Successful abuse yields limited but real integrity and confidentiality impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) by allowing disallowed content or instructions to pass through the filter that is meant to stop them, undermining the gateway's role as a security boundary between MCP clients and downstream tool servers. There is no public exploit code or CISA KEV entry at time of analysis, and IBM has published a fix via its support portal, so exposure is limited to unpatched deployments reachable by an authenticated account.
Parameter injection in the IBM Security Verify Access (Verify Identity Access) reverse proxy - the WebSEAL component - lets unauthenticated, network-reachable attackers have crafted parameters carried into requests the proxy constructs toward back-end or third-party services, potentially manipulating how those downstream services interpret the call. Only deployments below the listed interim-fix levels (Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, plus their container variants) are affected, and realized impact depends heavily on the behaviour of the downstream service, which is why this is scored AC:H with a limited confidentiality but high integrity effect rather than an urgent, broadly weaponizable flaw. There is no public exploit identified at time of analysis and EPSS is only 0.15% (5th percentile), so this is a moderate-priority issue to schedule rather than an emergency; the vendor has published patch guidance.
IBM Business Automation Workflow (both containerized and traditional deployments) fails to enforce authorization checks on certain import operations, letting an authenticated user invoke restricted import actions they should not be permitted to perform. Successful abuse yields limited confidentiality and integrity impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) rather than full system compromise. No public exploit code has been identified and the flaw is not listed in CISA KEV, but IBM has published a vendor patch, so unpatched deployments remain exposed to any user holding a valid low-privileged account.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to plant JavaScript inside Web UI content that is later rendered to other users. When a victim loads the affected page, the injected script runs inside the application's trusted origin, enabling session-token or credential theft and UI manipulation (CVSS 3.1 6.4, CWE-79). IBM has published a fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to persist arbitrary JavaScript inside Web UI content, which then executes in the browser of any other user who views the affected page. Successful exploitation can disclose session credentials or other sensitive data belonging to the victim's trusted session, and can alter the intended behavior of the Web UI for that user. IBM has published an advisory and states that a fix is available from the vendor; no public exploit code or CISA KEV listing was identified at time of analysis.
IBM Cloud Pak for Business Automation is affected by HTML injection (CWE-80) in one or more web UI components, allowing an attacker who already holds low-privileged authenticated access to inject markup that executes in a victim's browser within the hosting site's security context. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting a network-reachable, low-complexity flaw that still requires authentication and victim interaction, with scope change because the injected script runs against the site's origin. No EPSS score, CISA KEV entry, or public exploit code was provided in the intelligence feed, so active exploitation is unconfirmed; IBM has published a fix advisory.
XML External Entity (XXE) injection in IBM MQ's mqweb MFT REST API allows network-accessible, low-privileged attackers holding MFT publish authority to read sensitive files from the MQ server filesystem or cause denial of service. Affected deployments span seven release trains across LTS and CD channels from version 9.1 through 10.0.0.0. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained by both authentication and a specific MFT publish privilege requirement.
Uncontrolled resource consumption in IBM Cloud Pak for Business Automation enables authenticated network users to exhaust service resources and trigger a denial of service condition. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, each capped at specific interim fix levels. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in IBM Cloud Pak for Business Automation allows authenticated remote users to invoke restricted API endpoints by supplying manipulated HTTP headers that the platform fails to adequately validate. Affected version lines include 24.0.0, 24.0.1, 25.0.0, and 26.0.0, each bounded by specific interim fix thresholds. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
IBM Sterling B2B Integrator (6.2.0.0 through 6.2.0.6_2, 6.2.1.0-6.2.1.2, 6.2.2.0-6.2.2.1) and IBM Sterling File Gateway Standard Edition in the same version ranges contain an improper authentication flaw (CWE-287) that lets a remote authenticated attacker bypass security restrictions. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating a low-privilege authenticated network attacker can gain limited read and modify capability without user interaction, but no confidentiality-integrity-availability loss beyond partial. There is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the available intelligence, so this appears to be a targeted-patch issue rather than a mass-exploitation emergency.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
A time-of-check to time-of-use (TOCTOU) race condition in IBM i releases 7.3, 7.4, 7.5, and 7.6 lets a local attacker win a race window during a privileged file-ownership operation and end up owning arbitrary file system objects on the system. Successful exploitation yields low-level confidentiality, integrity, and availability impact but crosses a security boundary (CVSS scope change), meaning objects outside the attacker's own authority can be reassigned. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the CVSS base score is 6.0.
Authenticated command injection in IBM i Access Family releases 1.1.2.0 through 1.1.9.15 allows a logged-in user to run arbitrary operating-system commands under their own normal user privileges by supplying a session file whose contents are parsed without proper input validation. Because the injected commands execute only with the rights of the invoking account, the confidentiality, integrity and availability impact is limited rather than system-wide. No public exploit code or CISA KEV activity is identified at time of analysis, and no EPSS score was supplied with the input data.
IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.15 fail to properly validate user-supplied input in the emulator macro 'RunProgram' action, allowing an authenticated user to execute arbitrary operating-system commands with normal user privileges through a crafted macro. The flaw is a classic OS command injection (CWE-78) reachable over the network at low complexity, but it grants no privilege escalation beyond the invoking user's own rights, which is why IBM rates it 6.3 rather than critical. There is no public exploit code and no CISA KEV listing at time of analysis, so this is a hardening and lateral-movement concern rather than an urgent emergency patch item.
Information disclosure in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows a remote authenticated attacker with only low-level privileges to obtain sensitive information, because authorization checks are not properly enforced on certain resources. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network reachability and low attack complexity but also that a valid account is a prerequisite, so unauthenticated external attackers cannot exploit it directly; there is no integrity or availability impact. At time of analysis there is no public exploit identified, and the primary risk is for multi-tenant or publicly registrable Langflow deployments where obtaining a low-privileged account is trivial. IBM has published a vendor advisory covering this issue.
Low-privileged authenticated users of IBM Langflow OSS 1.0.0 through 1.12.2 can retrieve credentials that the platform fails to protect adequately, exposing stored secrets such as integration keys and API tokens to any account holder on the instance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) confirms a network-reachable flaw requiring only low privileges and no user interaction, with a scope change and high confidentiality impact but no integrity or availability effect. Exploitation requires a valid authenticated session, which rules out anonymous internet attacks; no public exploit has been identified at time of analysis and IBM has published fixes via its support advisory, so the highest residual risk sits in multi-user or multi-tenant deployments where low-trust accounts coexist with high-value stored credentials.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 lets a remote attacker who already holds a valid low-privilege account or session reach files outside the intended restricted directory, exposing sensitive information hosted on or reachable from the Langflow instance (CWE-22). The flaw is network-reachable with low attack complexity and no user interaction required, but it is explicitly not unauthenticated - an attacker must first be able to log in, so internet-exposed deployments with self-service registration or shared credentials carry the greatest realistic risk. At the time of analysis no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV); IBM has published a fix through its support advisory.
Authenticated attackers holding low-privileged credentials on an IBM Financial Transaction Manager (FTM) 4.x for Red Hat OpenShift deployment can exploit an XML external entity (XXE) injection flaw to disclose sensitive files and internal resources readable by the application, rated CVSS 3.1 base 6.5 (MEDIUM) with high confidentiality impact and no integrity or availability effect. Exploitation requires network reachability to an FTM endpoint that parses attacker-supplied XML with external-entity resolution enabled, plus valid credentials (PR:L) and no user interaction; because FTM is typically deployed as an internal back-office payments/financial processing system rather than an internet-facing service, exposure is usually limited to authenticated users and adjacent network positions. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, and IBM has published an advisory for the affected versions.
Authenticated path traversal in the Universal Connector Oracle Wallet upload component of IBM Guardium Data Protection 12.2 lets a low-privilege remote user write files to arbitrary filesystem locations on the appliance. The attacker must already hold a valid account with access to the Universal Connector upload function (PR:L) and must craft a traversal sequence that lands a file somewhere useful, which is why the vector carries AC:H despite the high confidentiality and integrity impact. Exploitation has not been observed: CISA SSVC records Exploitation as none and there is no public exploit identified at time of analysis, so this is a genuine but moderate-priority issue rather than a widespread emergency - though the 'total' technical impact rating means a successful hit against a misconfigured deployment could be severe.
Authenticated SQL injection in the PESI service of IBM Guardium Data Protection 12.2 allows a logged-in attacker with network reachability to the service to inject SQL through a parameter and read sensitive records from the product's internal database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability effects, and the prerequisite is a valid Guardium session - there is no pre-authentication path. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; IBM has published a vendor advisory covering the fix, making this a genuine but conditional priority that is most urgent for internet- or broadly reachable PESI deployments with many low-privilege accounts.
In the Linux kernel, the following vulnerability has been resolved: s390/pai: Support CPU hotplug for PMU PAI The command 'perf stat -e pai_crypto/CRYPTO_ALL/ -- <command>' crashes the kernel when CPUs are hotplug added during that run. Root cause is the missing allocation of per-CPU data structures for that new CPU. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands # echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online Currently without a CPU hotplug handler, that new CPU has no per-CPU data infrastructure. The scheduler runs PMU call back function pai_add() to install the PMU support for that CPU before the task is being scheduled on that new CPU. In pai_add() instructions mp = this_cpu_ptr(pai_root[idx].mapptr); cpump = mp->mapptr; return a NULL pointer and the result is a kernel panic as variable cpump is used inside that function. Add CPU hotplug support for CPU add and delete and create the necessary per-CPU data infrastructure during CPU hotplug add processing. Same for CPU hotplug remove. This is done when the CPU is offline to ensure the data structures are available when CPU is made online and tasks are scheduled on it. [hca@linux.ibm.com: fixup error path in pai_init()]
In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: mal: fix potential system hang in mal_remove() napi_disable() is not idempotent and calling it on an already-disabled or unenabled NAPI context will cause the kernel to spin indefinitely waiting for the NAPI_STATE_SCHED bit to clear. In mal_remove(), napi_disable() is called unconditionally. If no MACs were registered, NAPI was never enabled. Also, if they were registered but subsequently unregistered, NAPI was already disabled in mal_unregister_commac(). In either case, calling napi_disable() causes the kernel to hang upon module removal. Fix this by only calling napi_disable() in mal_remove() if the commac list is not empty (which implies NAPI is enabled).
An authenticated administrator can read files outside the configured log directory in IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 by abusing a prefix-only path check on the Admin API log-download endpoint GET /v1/admin/logs/file. Because the confinement test uses str.startswith(), a crafted filename that resolves into a sibling directory sharing the LOG_FOLDER string prefix is accepted, exposing .log, .jsonl and .json files - but not arbitrary filesystem content, since only those extensions and prefix-adjacent paths are reachable. Exploitation requires a high-privileged (PR:H) admin account, and no public exploit identified at time of analysis; the C:H confidentiality rating overstates practical risk given the admin prerequisite and the narrow set of reachable files.
IBM Concert 1.0.0 through 3.0.0 contains a local information disclosure flaw in its recursive directory-copy functionality, where a lack of proper access controls can lead to the unintentional inclusion of sensitive or unnecessary files, increasing the attack surface. The vulnerability requires local access to the host and is modeled as unauthenticated (PR:N) with no user interaction (UI:N), but its impact is bounded to confidentiality loss (C:H) with no integrity or availability impact. No public exploit code has been identified, and the vendor has released a patch via IBM support.
Hypervisor memory disclosure in IBM PowerVM firmware (FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81) allows an attacker who already holds root inside a guest partition to read a limited, non-attacker-controlled portion of uninitialized hypervisor memory through a hypervisor call interface, potentially exposing sensitive data belonging to the hypervisor or to co-resident guest partitions. According to the assessed CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), exploitation requires local access and high privileges (root in a guest) and yields only a confidentiality impact of low severity, with no integrity or availability effect and no attacker control over which memory contents are returned. There is no public exploit code identified and no confirmed active exploitation (not listed in CISA KEV); the practical risk is concentrated in multi-tenant environments where untrusted parties run arbitrary guest OS images on shared Power hardware, while single-tenant systems face little exposure.
A limited out-of-bounds memory read in the host-facing BMC firmware management service of IBM OpenBMC can be triggered by a host system to crash that service and read a small amount of BMC internal memory, producing low confidentiality and availability impact (CVSS 3.4). Only agents who already hold high-privileged control of the managed host can reach the vulnerable interface, since the flaw sits on the local host-to-BMC path (AV:L, PR:H) rather than on the network. Affected firmware levels are FW1060.00 through FW1060.81, FW1110.00 through FW1110.31, and FW1120.00 through FW1120.01; there is no public exploit code identified and no confirmed active exploitation (not in CISA KEV), so the practical risk is low and is largely contingent on the host already being compromised at a privileged level.
Local users with only low-level privileges on IBM i systems running Db2 Mirror for i 7.4, 7.5, or 7.6 can obtain partial sensitive information because the product encrypts data using AES in Electronic Codebook (ECB) mode, a deterministic cipher mode that leaks patterns in the underlying plaintext. The exposure is limited to confidentiality (C:L) with no integrity or availability impact, and exploitation requires local access plus the ability to observe data produced by the affected encryption code path, giving a low overall severity of 3.3. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS probability was supplied, consistent with a low-priority informational-disclosure weakness.
Improper handling of sensitive data in the IBM PowerVM Hypervisor partition resource dump interface allows an authenticated administrator on the Hardware Management Console (HMC) or the Power service processor to obtain a limited snapshot of partition processor state, resulting in a confidentiality exposure on the managed system. Affected firmware spans the FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81 and FW950.00-FW950.H3 branches. Exploitation requires administrator-level credentials and adjacent-network reachability to the management plane (CVSS 3.1 base score 3.4, vector AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N); there is no public exploit identified at time of analysis, and the practical risk is low because the prerequisite privileged management access is itself a strong barrier and the disclosure is limited in scope.
Local root access inside a guest logical partition (LPAR) on IBM PowerVM systems running affected partition firmware allows an attacker to send a crafted request to the partition firmware runtime and crash it, with possible memory corruption. Rated CVSS 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), the flaw affects firmware lines FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81 and FW950.00 through FW950.H3; no public exploit has been identified at time of analysis, and the realistic outcome is denial of service to the partition firmware runtime rather than confirmed cross-partition code execution. The guest-root prerequisite makes this a bounded, low-priority risk relevant mainly to multi-tenant or compromised LPARs on shared Power hardware.
Root-level attackers inside an IBM PowerVM logical partition can corrupt the partition firmware runtime boot configuration stored in NVRAM, leaving that partition unable to boot until an operator manually deletes and recreates the partition configuration. The issue affects PowerVM firmware levels FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3, and requires pre-existing root privileges within the target partition (CVSS 3.1 AV:L/PR:H, base score 5.1) with no remote or unauthenticated path to exploitation. There is no public exploit identified at time of analysis and no confirmed active exploitation; the practical risk is post-compromise sabotage or persistence against the attacker's own partition rather than an initial-access vector.
Denial of service in IBM PowerVM Hypervisor firmware affects logical partitions running affected FW1120, FW1110, FW1060, or FW950 levels: an attacker who already holds root inside an LPAR can send a crafted RTAS firmware-to-OS request and crash that partition, making it unavailable. The vulnerability is local-only, requires high privileges, and is contained to the attacker's partition, so other LPARs on the same managed system are not affected. No public exploit was identified at time of analysis, and the CVSS 3.1 score is 5.1 (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
Limited information disclosure affects IBM PowerVM Hypervisor firmware on specific service-pack levels (FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, and FW950.00-FW950.H3), where an out-of-bounds read can expose a small amount of adjacent memory content to an attacker. Rated CVSS 4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the flaw requires no authentication or user interaction but is not reachable across the internet: the attacker must already sit on the same adjacent network segment and be able to reach a hypervisor firmware interface that processes malformed input. Impact is confined to partial confidentiality loss with no integrity or availability effect, and no public exploit identified at time of analysis; IBM has published a vendor fix advisory.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated user to read sensitive data, because namespace-wide secrets are exposed through file mounts that are reachable from the DataStage workload. The vulnerability is rated CVSS 8.8 by the vendor, but our independent assessment re-scores it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - a confidentiality-only issue with a scope change, reflecting that the exposed secrets belong to other tenants/services in the same Kubernetes/OpenShift namespace rather than to the vulnerable component itself; the source vector's claims of high integrity and availability impact are not supported by the CWE-200 description. Exploitation requires a valid authenticated account on the affected 5.4.0.0 build and no user interaction; there is no public exploit identified at time of analysis, and no EPSS or CISA KEV signal was provided. Organizations running this release should treat any credentials present in the affected namespace as potentially compromised.
Path traversal in IBM Concert 1.0.0 through 3.0.0 permits unauthenticated remote attackers to read files accessible to the Concert service account by sending crafted URLs containing dot-dot-slash sequences. The flaw has a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so impact is limited to confidentiality with no write or code execution. No public exploit code was identified at time of analysis, and IBM has made a patch available.
Improper access control in IBM Concert 1.0.0 through 3.0.0 lets a local attacker who already has access to the host modify application files that should be protected, yielding an integrity-only impact with no data disclosure or denial of service. The vendor CVSS vector is 6.2 with AV:L/PR:N, while the independent assessment rates PR:L because exploiting this flaw in practice typically requires at least a local account or a compromised co-resident process; IBM has released a vendor patch. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied. This is a genuine integrity risk but not a top-priority emergency, given the local attack vector and the product's limited deployment.
Log injection in IBM Concert 1.0.0 through 3.0.0 allows an authenticated low-privileged user to insert forged or misleading entries into application log files by supplying input that is written without neutralization of special characters such as CRLF sequences. The vulnerability is a CWE-117 improper output neutralization flaw with only a low integrity impact (C:N/I:L/A:N); it cannot be used to read data, execute code, or cause denial of service, and exploitation requires a valid low-privileged account (PR:L). No public exploit code exists and no active exploitation has been identified at time of analysis, and IBM has released a vendor patch.
IBM Guardium Data Protection 12.2 returns detailed technical error messages in the browser, allowing an authenticated administrative user to obtain sensitive information about the system. The issue is classified as CWE-209 (generation of error message containing sensitive information) with a CVSS 3.1 base score of 2.7 (Low) and a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, meaning exploitation requires a high-privileged account and yields only low confidentiality impact with no integrity or availability impact. No public exploit has been identified at time of analysis, and the vendor has published a patch advisory; the disclosed detail may be useful for follow-on attacks against the same system, but the prerequisites and limited impact make this a low-urgency issue.
IBM Concert 1.0.0 through 3.0.0 can be induced to return detailed technical error messages to a requesting browser, leaking implementation detail to a remote, unauthenticated attacker (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, C:L only, 5.3). Impact is limited to low-sensitivity information disclosure with no integrity or availability effect, so the practical value is reconnaissance for follow-on attacks, and only Concert instances whose web interface is reachable by the attacker are exposed. No public exploit identified at time of analysis, and IBM has published a vendor fix; the issue is a low-priority information-disclosure item rather than a standalone compromise vector.
Unauthenticated local invocation of the Business Rules Manager commands REST endpoint in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an actor who already has a foothold in the hosting environment exhaust resources and halt business-rule management functions. The flaw is a missing authentication check (CWE-306) in CommandsResource.java:31; the CVSS 3.1 vector (AV:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2) confirms that no credentials or user interaction are required, but also that the attack path is local and that the only impact is availability - there is no data disclosure or modification. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the local attack vector is the primary factor keeping this a low-to-moderate priority issue despite the 6.2 base score. A vendor patch is available per the IBM advisory.
Local privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an attacker who already holds a low-privileged foothold inside a running FTM container - such as a compromised service account or code execution gained through a separate flaw - elevate their privileges within that container. The issue is rated CVSS 3.1 base 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and stems from improper privilege management (CWE-250), meaning the component runs with more authority than it needs; the scope is unchanged, so the flaw by itself does not provide a path to the host node or to other containers. No public exploit identified at time of analysis, and exploitation requires local authenticated access with no remote or unauthenticated vector.
Open redirect in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated remote attacker craft a request with a manipulated Host header so that authenticated operators who follow an attacker-supplied link are bounced to an attacker-controlled site for credential phishing. The weakness resides in the PMP HostHeaderFilter (HostHeaderFilter.java:151) and is rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning there is no direct code execution, data modification, or service disruption and success depends entirely on social-engineering the operator into clicking the redirect. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
SQL injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote authenticated attacker to read sensitive data from the underlying database, with impact confined to confidentiality (CVSS 6.5, C:H/I:N/A:N). The flaw is network-reachable with low attack complexity and no user interaction, but exploitation is gated behind a valid authenticated account (PR:L) on the FTM deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix; practical risk is tempered by the product's restricted financial-sector deployment footprint, making this a moderate-severity, real-but-not-urgent issue.
Unauthenticated remote attackers can clear active chat sessions in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the component handling chat sessions performs improper authorization, rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Any network-reachable deployment of the FTM chat-session feature is exposed, and exploitation requires no credentials or user interaction - but the impact is deliberately narrow: no data can be read (C:N) and the only effect is disruption of in-progress chat sessions (I:L/A:L), making this a genuinely lower-tier issue despite the MEDIUM score. No public exploit identified at time of analysis, and CISA KEV does not list this CVE.
Improper enforcement of mutual TLS client-certificate verification in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can let an unauthenticated remote attacker who already holds a position on the network path obtain sensitive information from the service. The flaw (CWE-295) is rated CVSS 3.1 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning exploitation is remotely reachable yet constrained by high attack complexity and yields only limited confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the overall risk is genuinely low-priority despite remote reachability, and a vendor patch is available.
Authenticated remote users of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can forge entries in the transaction audit log by supplying a crafted HTTP header that the application fails to validate properly. Successful abuse requires only valid low-privilege credentials (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the practical consequence is limited to the integrity of the audit trail - no data disclosure, no service disruption, and no unauthenticated attack path. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided; combined with the narrow, specialized deployment footprint of the platform, this is a genuinely low-priority issue whose signals are consistent rather than conflicting.
Improper authorization controls in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let an authenticated, low-privilege user forge identities and act as another user across the network, bypassing the platform's security checks. Only integrity is affected - an attacker can perform unauthorized actions under a spoofed identity, but there is no exposure of confidential data and no denial-of-service impact, and a valid account on the FTM instance is a prerequisite (PR:L, so the flaw is not exploitable pre-authentication). No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; with a CVSS base of 6.5 and a narrow deployment footprint in financial transaction environments, it is a genuine but moderate-priority issue.
Resource exhaustion in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows unauthenticated attackers on an adjacent network segment to force a denial-of-service condition by driving endpoint behavior that allocates resources without limits or throttling (CWE-770). The assigned CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) confines the attack surface to callers who can already reach a vulnerable FTM endpoint from the same network segment or cluster network, and limits the outcome to availability loss - service crash or hang - with no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and IBM has published a vendor advisory with remediation guidance, making this a mid-severity availability issue rather than an urgent priority.
Authenticated path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote attacker holding a valid FTM account manipulate file paths in a file-handling operation so that files are written or modified outside the intended directory. Because the flaw requires authentication and yields only limited integrity and availability impact - with no confidentiality exposure and no user interaction - it scores 5.4 and represents a medium-severity, low-priority issue rather than a high-urgency one. A vendor patch is available via IBM support node 7288641, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift ships with missing server-side authorization checks on payment-mutation functions, letting a low-privileged authenticated user invoke actions reserved for higher-privileged roles. The flaw is network-reachable and low-complexity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5 Medium), with the damage confined to integrity - unauthorized modification or execution of payment transactions - and no confidentiality or availability impact. Exploitation requires a valid FTM for Red Hat OpenShift account (PR:L) plus reachability of the affected payment endpoints; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has published a fix.
Cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to inject HTML/JavaScript that executes in the browser of a logged-in FTM operator, because HTML input is not properly neutralized (CWE-79). Exploitation requires the victim to load attacker-controlled content while holding an authenticated FTM session, so a successful attack is gated on user interaction and is confined to the victim's browser context rather than the FTM host itself. IBM has published a vendor advisory with fix guidance, no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided; the independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, a lower integrity impact than the 8.2 base score supplied with the CVE, and the deployment is narrowed by FTM's specialized financial-transaction-processing footprint on OpenShift.
Local attackers with a low-privileged account on the host or container running IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can read insufficiently protected credentials, potentially enabling lateral movement or further compromise. No public exploit was identified at time of analysis, and exploitation requires an existing local foothold-remote or unauthenticated access is not possible. Despite the MEDIUM 6.5 base score, this is a genuinely LOW-priority issue because it only affects confidentiality and benefits an attacker post-compromise.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains an XML external entity (XXE) flaw that lets an authenticated, low-privilege user who can reach an XML-accepting endpoint coerce the application's XML parser into resolving attacker-supplied external entity references, resulting in disclosure of sensitive information such as local files or internal service responses. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) the attack is network-reachable but requires a valid low-privilege account and an application code path that parses untrusted XML with external entity/DTD resolution left enabled, and our independent assessment scores the impact as confidentiality-only (C:H/I:N/A:N) rather than the vendor's mixed confidentiality/integrity rating. Exploitation is gated by authentication and by the presence of a suitable XML-processing entry point, and no public exploit identified at time of analysis; a vendor patch is available, which together keep this a mid-severity, configuration-dependent information-disclosure issue rather than an urgent priority.
An authenticated remote user of IBM Concert versions 1.0.0 through 3.0.0 can degrade or deny service availability by driving storage consumption past the limits the product is supposed to enforce. The vulnerability is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker needs a valid account and network reachability to the Concert service but no user interaction; the only impacted security property is availability, with no confidentiality or integrity loss. Exploitation requires the improperly enforced storage limits tracked as CWE-400 to be exhausted, so the practical effect is resource exhaustion leading to denial of service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and a vendor patch is published, which materially lowers the urgency of this availability-only issue.
Server-side request forgery in IBM Concert 1.0.0 through 3.0.0 allows an attacker who holds valid credentials to make the application issue HTTP requests to URLs of their choosing, which can be used to enumerate internal network services and set up follow-on attacks. The impact is bounded: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 6.5 by the vendor) reflects limited confidentiality and integrity loss rather than code execution or arbitrary file read, and exploitation requires a reachable Concert feature that dispatches server-side requests to a user-influenced URL. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (it is not in CISA KEV); IBM has published a fix via its support advisory.
Build-context directories belonging to IBM Concert 1.0.0 through 3.0.0 are recursively copied into produced container images, so any sensitive files sitting in that context (credentials, config files, keys, environment files) are baked into the image layers and disclosed to anyone who can pull the image or read its filesystem. The issue is local in nature (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 6.2): an attacker must already be able to obtain or access the built image, and no authentication or user interaction is involved, but the confidentiality impact on whatever was left in the build context is high, with no integrity or availability effect. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis, so this is a genuine but low-urgency information-disclosure hygiene defect that matters most where images are pushed to shared or externally reachable registries.
Uncontrolled resource consumption in IBM Concert 1.0.0 through 3.0.0 allows a remote, unauthenticated attacker to degrade service availability by feeding a specially crafted regular expression through the affected input-processing path, causing excessive CPU and memory consumption. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N, availability impact Low only), no credentials or user interaction are required, but the practical blast radius is bounded: only availability is affected, so expect slowdowns or partial unavailability rather than data compromise or full host takeover, and only on Concert deployments that actually expose the vulnerable input surface to untrusted traffic. No public exploit code has been identified at time of analysis and there is no indication this issue is confirmed actively exploited (CISA KEV); the vendor has published a fix advisory, making this a genuine but low-priority patching item.
IBM Concert 1.0.0 through 3.0.0 uses weaker-than-expected cryptographic algorithms that can expose highly sensitive information to decryption by an attacker who obtains the protected data. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, so no authentication or user interaction is required per the vector, but exploitation is constrained by high attack complexity and the need to acquire ciphertext before breaking the weak cryptography. No public exploit identified at time of analysis and no CISA KEV entry were provided; a vendor patch is available via IBM support node 7288830.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated remote attacker inject arbitrary JavaScript into web management pages that is then executed in the browser of a user who views the injected content, because user-supplied input is not properly neutralized during page generation (CWE-79). Exploitation requires a valid low-privileged session on the appliance (CVSS vector PR:L) and, in practice, a second user - typically an operator or administrator - to render the tampered page, which is why our independent assessment scores it slightly differently from the vendor's CVSS 3.1 base of 5.9 (vendor UI:N, assessed UI:R with scope change). No public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the high attack complexity, the credential prerequisite, and the confined web-management context of a niche data-security appliance.
Server-side request forgery in the IBM i FTP server (releases 7.3, 7.4, 7.5, and 7.6) lets an authenticated FTP user bypass security restrictions and pivot to internal network services by supplying crafted PORT and EPRT commands. The flaw is an improper-validation issue (CWE-918) with a scope change because the FTP component directs connections to services outside its own security boundary; scoring is CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), so exploitation requires valid FTP credentials and network reachability of the FTP service, and impact is limited to confidentiality and integrity of whatever internal services the IBM i host can reach. Per the independent assessment this is a genuine but moderate-priority issue rather than an emergency, and no public exploit identified at time of analysis; the vendor has published a fix.
Denial of service in IBM i 7.3, 7.4, 7.5, and 7.6 allows unauthenticated attackers on an adjacent network segment to disrupt the integrated FTP server by sending authentication commands that are not properly validated. Because the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, the credential-free USER/PASS handshake is the likely trigger path, but realistic exposure is confined to LAN or same-broadcast-segment reachability rather than arbitrary internet access, and there is no confidentiality exposure or code execution evidenced. IBM has published a vendor fix, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a moderate-severity, low-real-world-priority issue.
HTTP request smuggling in IBM WebSphere Application Server and WebSphere Application Server Liberty - as bundled in IBM CICS TX Advanced per the affected CPE - lets remote attackers desynchronize request framing between a front-end intermediary and the WebSphere back end, enabling request tampering or response poisoning. Exploitation requires the server to sit behind a reverse proxy, load balancer, or CDN that parses Content-Length/Transfer-Encoding framing differently than the back end; no authentication or user interaction is needed (PR:N/UI:N), but attack complexity is high (AC:H) because the attacker must find and reliably trigger a specific parser discrepancy in the real deployed chain, and a directly exposed server with no divergent front-end parser is not smuggle-able. Impact is bounded to low confidentiality and integrity with no availability effect (CVSS 3.1 base 4.8); this is a genuine but modest-severity issue rather than a top priority, and no public exploit was identified at time of analysis.
Adjacent-network attackers can drive the Name Service component of IBM WebSphere Application Server 8.5 and 9.0 into a denial-of-service condition by supplying maliciously crafted serialized data to the CORBA/IIOP naming endpoint, which the JVM then deserializes. The flaw is unauthenticated and requires no user interaction (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.5), so the practical barrier is network position rather than credentials: the attacker must be able to reach the Name Service on the same or an adjacent network segment, and default configurations leave that service listening on the network. Impact is confined to availability - no loss of confidentiality or integrity is assessed - and no public exploit code or confirmed active exploitation has been identified at time of analysis; IBM has published a vendor fix.
HTTP request smuggling in IBM WebSphere Application Server 8.5 can allow unauthenticated remote attackers to desynchronize request processing when the server sits behind or in front of an HTTP intermediary with mismatched Content-Length parsing, potentially leading to credential theft, cache poisoning, or request hijacking. The flaw (CWE-444) rates 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) and requires a specific proxy-layer mismatch and concurrent traffic; no public exploit identified at time of analysis. Vendor patch is available and the risk is assessed as moderate and non-urgent.
Virtual host isolation bypass in IBM WebSphere Application Server and WebSphere Application Server Liberty, as bundled in IBM CICS TX Advanced 10.1, allows remote requests addressed to one configured virtual host to reach resources belonging to another virtual host on the same instance. The vendor assigns CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-284); our independent assessment keeps the same unauthenticated, low-confidentiality/low-integrity, no-availability profile but raises attack complexity to AC:H because the weakness is only meaningful when an instance is configured to serve multiple distinct virtual hosts, while a default single-virtual-host deployment offers little to bypass. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available per the IBM advisory.
HTTP request smuggling in IBM WebSphere Application Server Liberty - the runtime bundled with IBM CICS TX Advanced 10.1 - lets remote, unauthenticated attackers desynchronize HTTP message framing between an upstream HTTP parser and the Liberty backend, so a smuggled request can be processed as if it came from the trusted front-end, with low confidentiality and integrity impact on subsequent requests sharing the connection. Exploitation requires a multi-tier topology (reverse proxy, load balancer, or CDN in front of or behind Liberty) where the two parsers disagree on Content-Length/Transfer-Encoding or chunked framing, and is rated high complexity because the specific parsing gap must be discovered and precisely crafted while connection reuse must be achievable; no user interaction is required. Risk is moderate and consistent with the vendor CVSS of 4.8 (Medium); no public exploit identified at time of analysis, and patch is available from the vendor.
Missing authorization checks in the IBM WebSphere Application Server 8.5 and 9.0 administrative console allow a remote, unauthenticated attacker (per the CVSS vector PR:N) to read limited sensitive information exposed by affected console functions. The issue is rated low severity (CVSS 3.1 base 3.7, C:L/I:N/A:N) and carries a high attack complexity (AC:H), meaning the attacker must know and reach the specific console paths where checks are absent rather than sending a single trivial request. There is no public exploit identified at time of analysis, no indication of confirmed active exploitation (CISA KEV), and a vendor patch is available via IBM's advisory page.
IBM WebSphere Application Server 9.0 and 8.5 allow remote, unauthenticated attackers to obtain sensitive file-system information through the FileTransfer servlet due to incorrect authorization (CWE-863). Exploitation requires network access to the servlet endpoint, which is part of the administrative/deployment interface, and impact is limited to confidentiality (CVSS 5.3, C:L). No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available per IBM's advisory.
Unauthenticated network access to the SOAP/JMX administrative connector on IBM WebSphere Application Server 8.5 and 9.0 can bypass authentication, allowing an attacker to read limited information from the server (CWE-306, CVSS 5.3). The flaw is remotely reachable without credentials or user interaction (PR:N/UI:N/AC:L), but impact is confined to low confidentiality loss - no code execution, configuration change, or denial of service. A vendor patch is available per IBM's advisory; no public exploit has been identified at time of analysis, and real-world exposure is constrained by the fact that the SOAP/JMX connector is normally bound to a management interface that hardened deployments segment or firewall from untrusted networks.
Log injection in IBM WebSphere Application Server 9.0 and 8.5 lets remote, unauthenticated attackers corrupt server log content by supplying a crafted LTPA token cookie that the application writes to its logs without neutralizing control characters. The impact is limited to integrity (CVSS 3.1 base score 3.7, I:L) with no confidentiality or availability loss and no code execution, and exploitation is rated high complexity because the injected content must survive into the log in a form a human or downstream log consumer then misinterprets. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; a vendor patch is available per the IBM advisory.
File-system information disclosure in IBM WebSphere Application Server 9.0 and 8.5 lets an attacker positioned on an adjacent network segment query the FileTransfer servlet and learn details about the server's file system, such as file and directory names or paths. Per the vendor-supplied vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3), the flaw is rated unauthenticated and requires no user interaction, but the adjacent-network precondition means the attacker must already sit on the same management/admin LAN or WebSphere Network Deployment segment rather than reaching the service from the open Internet, and impact is limited to low-confidentiality disclosure with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; overall this is a low-priority issue, though it is notable because WebSphere is widely deployed in large enterprises.
HTTP request smuggling (CWE-444) in IBM WebSphere Application Server 8.5, 9.0, and Liberty lets an authenticated, low-privileged remote attacker desynchronize HTTP request framing between WebSphere and an intermediary so that one user's request boundaries are misattributed on a shared connection. The issue only manifests when WebSphere sits behind or in front of a second HTTP parser (reverse proxy, load balancer, or CDN) that disagrees with WebSphere on Content-Length versus Transfer-Encoding chunked handling; a standalone WebSphere instance with no fronting or backend HTTP hop is not affected, and the 4.2 score reflects high attack complexity, partial confidentiality and integrity impact, and no availability or scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available per IBM's advisory.
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2) Web UI lets an unauthenticated attacker embed arbitrary JavaScript that executes in a victim's browser session, potentially altering page behavior and exposing credentials. The vulnerability is remote and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1), meaning a user - typically an administrator or operator - must load the attacker-influenced page inside an authenticated, trusted session for the payload to fire; no attacker authentication is required. There is no CISA KEV entry and no public exploit identified at time of analysis, and a vendor patch is available, so this is a genuine but moderate-priority issue whose real-world risk depends largely on whether the licensing Web UI is exposed to untrusted or internet-facing users rather than confined to an isolated management network.
Cross-site scripting in the IBM Common Licensing Agent and ART Web UI (9.0, 9.0.0.1, 9.0.0.2) lets an unauthenticated attacker embed arbitrary JavaScript into the interface, which executes in the browser of any user who is lured into rendering the crafted content; because the script runs inside a trusted, authenticated licensing session, the realistic outcome is theft of that session's credentials or manipulation of the displayed licensing data. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) confirms no attacker authentication is needed but that exploitation depends on victim interaction, and the changed scope indicates the injected payload can affect resources beyond the vulnerable component. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); the vendor has published a fix, and the primary limiting factor remains the narrow footprint of the licensing component and the requirement for a reachable Web UI plus a legitimate user to trigger the payload.
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting Tool (ART) 9.0 through 9.0.0.2 allows an authenticated low-privilege user to cause error messages to reveal environment, user, or associated data details. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (CVSS 4.3), so exploitation requires valid authentication, has low complexity, and yields only reconnaissance-grade confidentiality impact with no integrity or availability impact. No public exploit was identified at time of analysis, and this is a low-priority information-disclosure issue rather than an actively exploited flaw.
Cross-site scripting in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2 allows a user who already holds a low-privilege account on the licensing Web UI (PR:L) to embed arbitrary JavaScript that executes in another user's trusted session when that victim loads the tainted page (UI:R), potentially disclosing credentials or other session data. The flaw is rated CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and carries CWE-79; exploitation is limited to authenticated attackers and depends on a victim viewing the affected content, so it is not remotely exploitable without credentials or user interaction. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV); a patch is available from the vendor.
Cross-site scripting in IBM Common Licensing Agent 9.0 through 9.0.0.2 and ART 9.0 through 9.0.0.2 lets remote, unauthenticated attackers (CVSS PR:N) embed arbitrary JavaScript in the licensing Web UI, which executes in the browser of a victim who interacts with the crafted content (UI:R), potentially disclosing credentials or session data within a trusted session (CVSS 6.1, S:C/C:L/I:L/A:N). Only these specific Agent and ART builds are affected, and because the component is a backend licensing interface rather than a public-facing web application, opportunistic drive-by exploitation is limited; no public exploit identified at time of analysis. Successful exploitation still depends on a logged-in operator or administrator viewing attacker-influenced content, which is the primary limiting factor.
IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 send sensitive data in cleartext, allowing an attacker who occupies a man-in-the-middle position on the network path to capture confidential information. Exploitation requires an on-path adversary (e.g., via ARP or DNS spoofing or a compromised intermediary) but no authentication or user interaction; the CVSS 3.1 base score is 5.9 with high confidentiality impact but no integrity or availability impact. No public exploit code or confirmed active exploitation has been identified, and IBM has released a patch.
IBM Controller 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 permit an authenticated low-privilege user to bypass file-size validation by tampering with client-side input, producing low integrity and availability impact without confidentiality exposure. The issue is rated CVSS 5.4 and assessed as a moderate, not a priority, issue; no public exploit identified at time of analysis. A vendor patch is available per IBM advisory, and exploitation requires a valid IBM Controller account with network access.
Reflected cross-site scripting in IBM Financial Transaction Manager for SWIFT Services for Multiplatforms (versions 3.2.4.0 through 3.2.4.16) lets an unauthenticated attacker inject arbitrary JavaScript into the Web UI, which then executes in the browser of any authenticated user who loads the crafted content. Because the payload runs inside a trusted, already-authenticated session, the realistic impact is disclosure of that user's credentials or session data rather than server compromise; exploitation is constrained by the mandatory requirement that a victim interact with attacker-supplied content (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/). No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor has published remediation guidance.
IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 embed sensitive information within source code delivered to clients, allowing an authenticated user with access to that code to harvest data that can be used to mount further attacks against the system. The flaw carries a CVSS base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires a valid Cognos Analytics account, so exploitation is gated behind existing credentials or a foothold rather than being openly reachable; impact is limited to low confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the issue has not been confirmed actively exploited (CISA KEV); vendor-released remediation is available, making this a low-priority hardening item rather than an urgent threat.
Authenticated users on the IBM TS4300 tape library management interface can degrade the appliance's email notification service by triggering requests faster than it can handle, due to missing interaction-frequency (rate) controls in firmware versions 1.1.0.1 through 1.7.1.1. The impact is confined to availability of the email/alerting subsystem (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L); the data path, stored data, and integrity are unaffected, and valid credentials are a hard prerequisite. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a low-priority, patch-available hardening issue.
Information disclosure in IBM Cognos Analytics 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2 allows an unauthenticated attacker on a shared network segment to capture sensitive data because the product uses insecure network communication (CWE-327). Exploitation requires the attacker to achieve a man-in-the-middle or traffic-capture position on the same network, making it impractical over the open internet; the impact is limited to confidentiality. The vendor CVSS score of 5.9 is a fair reflection of the moderate risk, no public exploit code has been identified, and a vendor patch is available.
IBM QRadar deployments running 7.5.0 through 7.5.0 UP15 Interim Fix 006 expose sensitive backup-file contents to any holder of a valid QRadar account, because those backup files are stored with incorrect permissions. Exploitation requires authentication (CVSS vector PR:L) but no administrative rights and no user interaction, and an attacker who satisfies that bar can read configuration, credential, or event data captured in the affected backups, yielding a high confidentiality impact (C:H) with no integrity or availability effect. This is a moderate-priority information-disclosure issue rather than a high-urgency emergency: no public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and the authentication prerequisite plus the need for an unpatched interim-fix level are the principal limiting factors.
Cross-site request forgery in IBM Common Licensing Agent and ART 9.0.x allows remote attackers to execute unauthorized actions on behalf of an authenticated user, with high integrity impact but no confidentiality or availability impact. Exploitation requires the victim to visit a malicious page while authenticated to the licensing web interface; no public exploit identified at time of analysis. Vendor assigned CVSS 10.0, but independent analysis assesses a more moderate risk due to the UI:R and S:U characteristics typical of CSRF.
Authenticated command injection in IBM Cloud Pak for Data 5.1.2 lets a network-reachable, low-privileged user run arbitrary operating-system commands with elevated privileges on the underlying system. The flaw is an improper-neutralization-of-special-elements issue (CWE-78) in how user-supplied input is validated before being passed to a shell, and it rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning full loss of confidentiality, integrity and availability on the affected host once the attacker has any valid account. IBM has published a fix via its support advisory; no public exploit code has been identified at the time of analysis and there is no confirmation of active exploitation (CISA KEV).
Path traversal in IBM Cloud Pak for Data 5.1.2 lets remote, unauthenticated attackers read arbitrary files from the server filesystem by sending crafted URL requests containing ../ (dot-dot-slash) sequences. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a straightforward, low-complexity information-disclosure issue with high confidentiality impact but no integrity or availability impact; no public exploit code was identified at time of analysis. Only version 5.1.2 is named as affected, and IBM has published a vendor fix, so exposure is limited to unpatched, network-reachable deployments of that release.
Unauthenticated remote attackers can degrade the email service of IBM Sterling Partner Engagement Manager (PEM) by flooding it with requests, exploiting improper control of interaction frequency (CWE-799) so the service is unable to keep up with legitimate mail processing. The affected releases are Essentials Edition 6.3.0.0 through 6.3.0.2 and 6.2.4.0 through 6.2.4.4, plus Standard Edition 6.2.4.0 through 6.2.4.4; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium), no authentication or user interaction is required against a default configuration when the email service is network-reachable. Impact is limited to partial availability loss (A:L) with no confidentiality or integrity effect and no scope change, so this is a service-degradation weakness rather than a full application outage; no public exploit code has been identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
IBM Controller releases 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 can return detailed technical error messages to the browser, allowing remote, unauthenticated attackers to harvest implementation details about the affected system (CWE-209). Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, exploitation is network-reachable and requires no credentials or user interaction, but the impact is confined to low-value information disclosure that is most useful as reconnaissance for follow-on attacks rather than for direct compromise. No public exploit code has been identified and the issue is not listed in CISA KEV, so this is a genuine but low-priority weakness whose practical risk largely depends on whether the Controller web interface is reachable from untrusted networks.
An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath queries and read data the query engine should never return, including sensitive application records and structural details of the underlying XML documents. All shipped 24.0.x, 25.0.0 and 26.0.0 streams are affected up to and including Interim Fix 001/005/008/009 respectively, and exploitation only requires a low-privileged, network-reachable session — no user interaction and no special complexity. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-on-schedule issue rather than an emergency.
Authenticated users of IBM ContextForge MCP Gateway through v1.0.4 can bypass the gateway's payload protection mechanisms because its recursive content inspection does not fully traverse deeply nested or embedded payload structures. Successful abuse yields limited but real integrity and confidentiality impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) by allowing disallowed content or instructions to pass through the filter that is meant to stop them, undermining the gateway's role as a security boundary between MCP clients and downstream tool servers. There is no public exploit code or CISA KEV entry at time of analysis, and IBM has published a fix via its support portal, so exposure is limited to unpatched deployments reachable by an authenticated account.
Parameter injection in the IBM Security Verify Access (Verify Identity Access) reverse proxy - the WebSEAL component - lets unauthenticated, network-reachable attackers have crafted parameters carried into requests the proxy constructs toward back-end or third-party services, potentially manipulating how those downstream services interpret the call. Only deployments below the listed interim-fix levels (Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, plus their container variants) are affected, and realized impact depends heavily on the behaviour of the downstream service, which is why this is scored AC:H with a limited confidentiality but high integrity effect rather than an urgent, broadly weaponizable flaw. There is no public exploit identified at time of analysis and EPSS is only 0.15% (5th percentile), so this is a moderate-priority issue to schedule rather than an emergency; the vendor has published patch guidance.
IBM Business Automation Workflow (both containerized and traditional deployments) fails to enforce authorization checks on certain import operations, letting an authenticated user invoke restricted import actions they should not be permitted to perform. Successful abuse yields limited confidentiality and integrity impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) rather than full system compromise. No public exploit code has been identified and the flaw is not listed in CISA KEV, but IBM has published a vendor patch, so unpatched deployments remain exposed to any user holding a valid low-privileged account.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to plant JavaScript inside Web UI content that is later rendered to other users. When a victim loads the affected page, the injected script runs inside the application's trusted origin, enabling session-token or credential theft and UI manipulation (CVSS 3.1 6.4, CWE-79). IBM has published a fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to persist arbitrary JavaScript inside Web UI content, which then executes in the browser of any other user who views the affected page. Successful exploitation can disclose session credentials or other sensitive data belonging to the victim's trusted session, and can alter the intended behavior of the Web UI for that user. IBM has published an advisory and states that a fix is available from the vendor; no public exploit code or CISA KEV listing was identified at time of analysis.
IBM Cloud Pak for Business Automation is affected by HTML injection (CWE-80) in one or more web UI components, allowing an attacker who already holds low-privileged authenticated access to inject markup that executes in a victim's browser within the hosting site's security context. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting a network-reachable, low-complexity flaw that still requires authentication and victim interaction, with scope change because the injected script runs against the site's origin. No EPSS score, CISA KEV entry, or public exploit code was provided in the intelligence feed, so active exploitation is unconfirmed; IBM has published a fix advisory.
XML External Entity (XXE) injection in IBM MQ's mqweb MFT REST API allows network-accessible, low-privileged attackers holding MFT publish authority to read sensitive files from the MQ server filesystem or cause denial of service. Affected deployments span seven release trains across LTS and CD channels from version 9.1 through 10.0.0.0. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained by both authentication and a specific MFT publish privilege requirement.
Uncontrolled resource consumption in IBM Cloud Pak for Business Automation enables authenticated network users to exhaust service resources and trigger a denial of service condition. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, each capped at specific interim fix levels. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in IBM Cloud Pak for Business Automation allows authenticated remote users to invoke restricted API endpoints by supplying manipulated HTTP headers that the platform fails to adequately validate. Affected version lines include 24.0.0, 24.0.1, 25.0.0, and 26.0.0, each bounded by specific interim fix thresholds. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
IBM Sterling B2B Integrator (6.2.0.0 through 6.2.0.6_2, 6.2.1.0-6.2.1.2, 6.2.2.0-6.2.2.1) and IBM Sterling File Gateway Standard Edition in the same version ranges contain an improper authentication flaw (CWE-287) that lets a remote authenticated attacker bypass security restrictions. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating a low-privilege authenticated network attacker can gain limited read and modify capability without user interaction, but no confidentiality-integrity-availability loss beyond partial. There is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the available intelligence, so this appears to be a targeted-patch issue rather than a mass-exploitation emergency.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
A time-of-check to time-of-use (TOCTOU) race condition in IBM i releases 7.3, 7.4, 7.5, and 7.6 lets a local attacker win a race window during a privileged file-ownership operation and end up owning arbitrary file system objects on the system. Successful exploitation yields low-level confidentiality, integrity, and availability impact but crosses a security boundary (CVSS scope change), meaning objects outside the attacker's own authority can be reassigned. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the CVSS base score is 6.0.
Authenticated command injection in IBM i Access Family releases 1.1.2.0 through 1.1.9.15 allows a logged-in user to run arbitrary operating-system commands under their own normal user privileges by supplying a session file whose contents are parsed without proper input validation. Because the injected commands execute only with the rights of the invoking account, the confidentiality, integrity and availability impact is limited rather than system-wide. No public exploit code or CISA KEV activity is identified at time of analysis, and no EPSS score was supplied with the input data.
IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.15 fail to properly validate user-supplied input in the emulator macro 'RunProgram' action, allowing an authenticated user to execute arbitrary operating-system commands with normal user privileges through a crafted macro. The flaw is a classic OS command injection (CWE-78) reachable over the network at low complexity, but it grants no privilege escalation beyond the invoking user's own rights, which is why IBM rates it 6.3 rather than critical. There is no public exploit code and no CISA KEV listing at time of analysis, so this is a hardening and lateral-movement concern rather than an urgent emergency patch item.