IBM
Monthly
OS command injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to disrupt system availability by submitting crafted input containing special elements that are improperly neutralized before being passed to OS-level commands. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms network-reachable exploitation requiring only low-privilege credentials, with high availability impact and a secondary low integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across actively supported IBM i releases make patching a priority for affected IBM Power Systems environments.
Parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to append unexpected parameters to system commands, with a vendor-confirmed availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) places this at Medium severity, requiring only valid credentials and network access with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
SQL parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to bypass security restrictions by submitting specially crafted SQL input that is not properly neutralized before processing. The CWE-78 (OS Command Injection) classification combined with the SQL-parameter attack surface suggests that malicious input may propagate beyond the SQL layer to OS-level command execution, though the exact propagation path is not fully detailed in available data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
SQL injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to modify data in certain SQL tables by injecting malicious SQL commands through improperly neutralized input. The CVSS score of 4.3 (Medium) reflects a constrained impact profile - integrity in specific tables is at risk, but confidentiality and availability are unaffected. A vendor patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.
SQL injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to modify SQL table data by injecting unsanitized special elements into SQL commands processed by the platform. The CWE-89 root cause confirms missing or inadequate input neutralization within IBM i's SQL handling layer, enabling unauthorized data manipulation. No public exploit identified at time of analysis; a vendor patch is available via IBM advisory 7283289.
Path traversal in IBM i 7.3 through 7.6 exposes sensitive files to remote authenticated attackers by failing to enforce restricted directory boundaries. The vulnerability (CWE-22) allows a low-privileged authenticated user to escape intended directory scope and read arbitrary file system paths, resulting in high confidentiality impact with no integrity or availability effect. No public exploit code or CISA KEV listing has been identified at time of analysis.
Session token validation bypass in IBM i versions 7.3 through 7.6 enables a remote low-privileged attacker to circumvent security restrictions by exploiting improper session token handling (CWE-294). The CVSS vector confirms network reachability but mandates high attack complexity and an existing authenticated foothold, capping the score at 6.8 Medium. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has issued a vendor patch.
Remote authenticated exploitation of a race condition in IBM i 7.3 through 7.6 allows attackers with low-privilege credentials to obtain sensitive information and bypass platform security restrictions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the flaw is reachable over the network without user interaction, though authentication is required. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via its support portal.
Stored cross-site scripting in IBM i versions 7.3 through 7.6 allows an authenticated low-privileged user to inject persistent JavaScript into the Web UI, executing it in other users' browser sessions within the same trusted environment. The Scope:Changed CVSS metric confirms the payload crosses session boundaries, enabling credential theft or session hijacking against other authenticated users. IBM has released a patch via advisory node/7283292; no public exploit code or active exploitation has been identified at time of analysis.
Security restriction bypass in IBM i 7.3 through 7.6 exploits an interpretation conflict in the multipart parser, enabling a remote attacker with high administrative privileges to circumvent configured access controls with low integrity impact. The flaw (CWE-436) arises when the security enforcement layer and the processing layer disagree on how to interpret multipart message boundaries, allowing carefully crafted requests to evade security checks. No public exploit code and no CISA KEV listing have been identified at time of analysis; IBM has released a patch via its support portal.
Path traversal in IBM i 7.3 through 7.6 enables remote authenticated attackers to read sensitive files outside authorized directory boundaries by supplying crafted path strings that the platform fails to properly validate (CWE-22). Impact is limited to confidentiality - no integrity or availability exposure - and exploitation requires prior authentication. A vendor-released patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.
Improper authorization in IBM i versions 7.3 through 7.6 allows remote authenticated attackers to bypass security restrictions and perform unauthorized write operations on protected objects or data. The flaw, rooted in CWE-285, requires only low-privilege credentials and no user interaction, making it accessible to any authenticated user on the platform. IBM has released patches via their support advisory, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege network attackers to inject directory traversal sequences into the username field, bypassing containment checks. Successful exploitation enables arbitrary directory deletion, cross-tenant data destruction, and deletion of JWT signing keys - the last of which forces platform-wide session invalidation for all users. No public exploit or CISA KEV listing has been identified at time of analysis, though the operational impact in multi-tenant deployments is severe despite the moderate CVSS score of 6.5.
Arbitrary file write via path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to create directories and write files to arbitrary locations on the server filesystem through the Knowledge Bases API. The flaw stems from unsanitized user-supplied knowledge base names being passed directly into file path construction, making exploitation straightforward once credentials are obtained. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Authenticated users in IBM Langflow OSS 1.0.0 through 1.10.3 can exploit a privileged built-in component to read arbitrary server-side environment variables, bypassing security controls designed to restrict custom component execution. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms this is a low-complexity, network-accessible flaw requiring only standard user credentials, with high confidentiality impact. No active exploitation confirmed via CISA KEV, and no public exploit code has been identified at time of analysis; IBM has released a patch via its support portal.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.3 allows low-privileged authenticated users to force the server to make arbitrary outbound HTTP requests to internal or restricted network destinations due to incomplete enforcement of the platform's built-in SSRF protections. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation at low complexity with high confidentiality impact, making cloud metadata endpoints and internal services realistic targets. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
Path traversal in IBM Langflow OSS 1.0.0-1.10.3 exposes arbitrary server filesystem files via a crafted MCP `resources/read` request using URL-encoded traversal sequences. Authenticated low-privilege users can read other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables - leaking the JWT secret effectively enables token forgery and full account takeover beyond what the CVSS 6.5 score implies. No public exploit identified at time of analysis; vendor patch is available per IBM advisory.
IBM Maximo Application Suite 9.0, 9.1, and 9.2 fails to set the `Secure` attribute on authorization tokens and session cookies, enabling interception of credential material over unencrypted HTTP. An attacker who tricks an authenticated user into following an HTTP link - via phishing or a malicious page - causes the victim's browser to transmit the session cookie in plaintext, where it can be captured by a server the attacker controls or via network sniffing. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, session token theft can lead to full account takeover, meaningfully exceeding the limited confidentiality scope implied by the raw CVSS score.
Session data tampering in IBM Maximo Application Suite 9.0, 9.1, and 9.2 is possible because the application signs session tokens with a weak HMAC secret, classified under CWE-330 (Use of Insufficiently Random Values). A remote unauthenticated attacker who can derive or predict the HMAC signing key may forge or modify session tokens, undermining session integrity across affected deployments. No public exploit code has been identified, this vulnerability is not listed in the CISA KEV catalog, and a vendor patch is available via IBM's advisory.
Improper TLS hostname verification in IBM Business Automation Workflow exposes high-privilege sessions to man-in-the-middle interception by failing to validate that server certificates match the target hostname. Affected deployments span both containerized (Kubernetes/OpenShift) and traditional on-premises models across multiple release trains from 24.0.0 through 26.0.0. No public exploit has been identified and the vulnerability is not listed in CISA KEV; real-world risk is substantially bounded by the PR:H requirement - an attacker must already hold administrative credentials before exploitation is feasible.
Unauthenticated remote information disclosure in IBM Cloud Pak for Business Automation 24.0.0 through 26.0.0 allows network attackers to retrieve sensitive data embedded in externally accessible manifest files. The vulnerability stems from CWE-538, where sensitive configuration or operational data is written into manifest files that are not adequately protected from external access. No public exploit has been identified at time of analysis, and a vendor patch is available via IBM's support portal.
Plugin output logs in IBM UrbanCode Deploy and IBM DevOps Deploy expose sensitive step values to any authenticated user with log access, across a wide range of actively-maintained versions spanning both product lines. The CVSS PR:L vector confirms that a low-privileged authenticated user - such as a developer or operator - who can view deployment logs may read sensitive values such as credentials, API tokens, or configuration secrets that plugin steps emit without redaction. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is practically elevated in CI/CD environments where plugin steps routinely handle high-value secrets.
XML External Entity injection in IBM DataPower Gateway 10.5.0, 10.6.0, and 10.6CD allows a privileged authenticated user who can submit XML data to the gateway to either exfiltrate sensitive information from the underlying system or trigger memory exhaustion through recursive or large entity expansion. The vulnerability exists in the gateway's XML processing pipeline, a core function of this API/ESB platform. No public exploit code has been identified at time of analysis, and the vendor has released a patch documented in IBM Security Advisory 7278748.
Cross-site scripting in IBM Engineering Requirements Management DOORS Web Access allows unauthenticated remote attackers to inject arbitrary JavaScript into the Web UI by tricking an authenticated user into interacting with a malicious payload, potentially resulting in credential disclosure within a trusted session. Affected versions span two maintained branches: 9.7.2.1-9.7.2.11 and 9.6.1.1-9.6.1.13. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and IBM has released a patch via advisory 7279145.
Denial of service in IBM Db2 federated server (versions 12.1.0 through 12.1.4) can be triggered by executing non-fenced federated queries, causing the database engine to exhaust resources and become unresponsive. The root cause is CWE-400 (Uncontrolled Resource Consumption) within the in-process federated wrapper execution path. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Cross-site scripting in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.2.0-6.2.2.0_1 enables any authenticated low-privilege user to inject persistent JavaScript into the Web UI, which executes within the browser session of other authenticated users who load the affected page. The changed scope (S:C in CVSS) reflects that the injected script runs in the victim's browser context rather than the originating user's, enabling credential harvesting or session token theft within the trusted application session. No public exploit code or CISA KEV listing exists at time of analysis; IBM has issued a patch.
Cross-site scripting in the Ebics server component of IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privileged users to inject arbitrary JavaScript into the Web UI, executing in the browser context of other users within a trusted session. Both products across four version branches (6.1.2.x, 6.2.0.x, 6.2.1.x, and 6.2.2.0) are affected, with the primary risk being credential disclosure or session hijacking of higher-privileged users including administrators. IBM has released a patch; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in the Administrative Console of IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server allows an authenticated low-privileged user to inject malicious JavaScript that executes in the browser of other users who view the affected console page. The CVSS scope change (S:C) confirms the attack crosses security boundaries, enabling impact on sessions belonging to higher-privileged administrators. No active exploitation has been identified; no public POC is known at time of analysis.
Cross-site scripting in IBM WebSphere Application Server traditional 8.5 and 9.0 allows remote attackers to inject arbitrary JavaScript or HTML via reflected input. A crafted link clicked by an authenticated user can execute scripts in the victim's browser, leading to session hijacking or credential theft. No active exploitation or public exploit code is currently known, and a vendor patch is available.
Information disclosure in the dashboard component of IBM Sterling B2B Integrator and File Gateway 6.2.x allows low‑privileged authenticated users to view sensitive details embedded in source code comments. No active exploitation or public proof‑of‑concept code is known at this time; the advisory carries a CVSS base score of 4.3 and is categorized as low severity.
Information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.x allows authenticated remote attackers to view sensitive data embedded in source code comments of a mailbox component. Affected versions include 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation has been reported.
Information disclosure in IBM Sterling B2B Integrator and File Gateway 6.2.x allows authenticated privileged users to read sensitive data from application log files. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.8 when the restConnector-2.0 feature is enabled, allowing authenticated remote attackers with low privileges to exhaust server resources via uncontrolled recursion (CWE-674). The attack does not require user interaction and can be conducted over the network, resulting in high availability impact and potential partial confidentiality disclosure. No public exploit or active exploitation has been confirmed at time of analysis.
Improper TLS certificate validation in IBM TS4500 CLI tool versions 0.1.31 through 1.12.0.0 allows man-in-the-middle attackers to obtain sensitive information. The attack is remotely exploitable with high complexity but requires no authentication or user interaction. No public exploit or active exploitation has been identified at the time of analysis.
Physical access to IBM PowerVM Hypervisor firmware with Transparent Memory Encryption (TME) enabled can allow an attacker to decrypt protected memory contents due to insufficient entropy. This information disclosure vulnerability affects firmware versions FW1110.00–FW1110.20 and FW1060.00–FW1060.71, potentially exposing sensitive data stored in memory. No public exploit code or active exploitation evidence is available at the time of analysis.
Improper access control in IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privilege users to view sensitive data restricted to privileged users. The vulnerability has a CVSS 3.1 base score of 4.3 (low severity) and affects specific version ranges of both products. No public exploit or active exploitation has been identified, and IBM has released a patch.
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.
Stored cross-site scripting in IBM Sterling B2B Integrator and File Gateway allows privileged users to inject arbitrary JavaScript into the Web UI, altering intended functionality and potentially leading to credential disclosure within trusted sessions. No public exploit identified at time of analysis.
Unauthenticated information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway allows remote attackers to read sensitive data by sending a specially crafted HTTP request that bypasses authentication controls. Affected deployments span versions 6.2.0.0 through 6.2.2.0_1 across both products, covering a wide span of the 6.2.x release train. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch and published an advisory.
Cross-site scripting in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 enables remote attackers to inject and execute arbitrary script code within a victim's browser session through unsanitized input that is rendered during web page generation. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms remote, unauthenticated exploitability contingent on victim interaction, consistent with reflected or stored XSS. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via its support portal.
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 expose an open redirect flaw (CWE-601) that enables remote attackers to silently redirect authenticated or unauthenticated users to arbitrary attacker-controlled websites by supplying a crafted URL. The vulnerability requires no privileges but does require user interaction, making it a phishing-enablement risk rather than a direct system compromise vector. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7279964.
Race condition in IBM Cognos Analytics 12.1.3 (builds through 12.1.3-2606251736) allows authenticated users to obtain incorrect report summary results belonging to other users or trigger report-processing failures by exploiting improper synchronization in the Agentic AI assistant's concurrent request-handling logic. The flaw requires authenticated access and concurrent user activity, limiting opportunistic exploitation, though in high-concurrency enterprise deployments the race window may be reliably triggered. No public exploit code or active exploitation has been identified; a vendor patch is available.
IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorrect authorization flaw (CWE-863) that allows an authenticated attacker with read-only privileges to perform unauthorized modifications and deployments outside their assigned permission scope. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective Container variants. A vendor patch is available per IBM advisory 7279510; no public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attackers to craft malicious URLs that redirect victims to arbitrary attacker-controlled websites, enabling phishing campaigns that exploit the trusted reputation of enterprise IAM infrastructure. Affected deployments span both on-premises and containerized editions across IBM Verify Identity Access 11.0-11.0.2 and IBM Security Verify Access 10.0-10.0.9.1. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7279510.
Server-side request forgery in IBM Langflow OSS (versions 1.0.0 through 1.10.0, and Langflow 1.9.0) allows an authenticated low-privileged user to coerce the server into making attacker-controlled outbound requests, reaching internal services and exfiltrating their responses. The flaw stems from an insecure default configuration combined with incomplete enforcement of the built-in SSRF protection, meaning the safeguard can be bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.
Denial of service in IBM Db2 11.5.x and 12.1.x allows a local database user to crash the database engine by submitting specially crafted SQL statements containing subqueries that trigger an infinite loop (CWE-835) in the query compiler. The vulnerability spans two active major release lines - 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 - covering a broad swath of IBM's current Db2 product lifecycle. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via the vendor advisory.
IBM Security Verify exposes sensitive internal information to unauthenticated remote attackers through overly detailed technical error messages rendered in the browser. Affected deployments span four product variants - IBM Verify Identity Access, IBM Security Verify Access, and their respective container editions - all of which share the same CWE-209 root cause. No public exploit code or CISA KEV listing exists at time of analysis; the primary risk is reconnaissance enablement, where leaked error details lower the effort required for subsequent, more severe attacks.
Stored/reflected cross-site scripting in the administrative console of IBM WebSphere Application Server 9.0 and 8.5 lets an adjacent-network attacker inject malicious script that executes in an administrator's browser session. Because the CVSS scope is changed and impact is rated high, a successful injection could let the attacker hijack the privileged admin session and pivot to broader server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Cleartext data transmission in IBM watsonx.data intelligence versions 5.2.2 through 5.3.1 (including patch-1) exposes sensitive information to network interception by a man-in-the-middle adversary. The platform transmits certain data without encryption, enabling an attacker positioned on the network path to capture confidential content in transit. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified; however, the CVSS High confidentiality impact (C:H) signals that the interceptable data is substantively sensitive, likely including queries, credentials, or intelligence payloads.
Temporary denial of service in IBM watsonx.data intelligence 5.2.0 through 5.3.0 is achievable by authenticated users who submit specially crafted HTTP requests, exploiting improper resource throttling allocation (CWE-770). The impact is limited to availability - confidentiality and integrity are unaffected - and the disruption is described as temporary rather than persistent. No public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting in IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 allows authenticated low-privileged users to inject persistent JavaScript into the Web UI, which then executes within the browser sessions of other authenticated users visiting the affected page. The CVSS scope change (S:C) confirms the payload crosses the security boundary from the attacker's session into victims' sessions, enabling credential harvesting within trusted contexts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored and persistent nature of the injection elevates operational impact beyond what the 6.4 base score alone conveys.
HTML injection in IBM watsonx.data Intelligence versions 5.2.0 through 5.3.0 enables a remote authenticated attacker to plant malicious HTML content that executes in a victim's browser within the hosting site's security context. The CVSS vector (PR:L/UI:R/C:H) confirms exploitation requires low-privilege authentication and a second user to view the injected content, with the primary impact being confidentiality loss - such as session token theft or credential harvesting. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; a vendor patch is available via IBM advisory 7277801.
Cross-site scripting in IBM watsonx.data Intelligence 5.2.0 through 5.3.0 allows low-privileged authenticated users to inject arbitrary JavaScript into the Web UI, enabling credential theft or session hijacking against higher-privileged victims. The CVSS scope change (S:C) confirms the injected script executes in the victim's browser context, crossing trust boundaries within the platform. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; IBM has released a patch via advisory PSIRT.
Server-side request forgery in IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 enables authenticated attackers to coerce the server into issuing arbitrary outbound HTTP requests to attacker-controlled destinations. The CVSS vector (PR:L) confirms exploitation requires a valid account, but no elevated privileges are needed beyond basic authentication. Primary impact is internal network enumeration and potential pivoting to services that trust the watsonx.data host, rather than direct data exfiltration. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in IBM UrbanCode Deploy and IBM DevOps Deploy exposes potentially sensitive data to any local user who can read application log files. Affected are UrbanCode Deploy 7.2 through 7.2.3.23 and 7.3 through 7.3.2.18, as well as DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the local no-privilege vector combined with high confidentiality impact makes this a meaningful insider threat and post-compromise escalation vector in enterprise CI/CD environments.
Sensitive configuration and secret disclosure in IBM UrbanCode Deploy (7.3-7.3.2.18) and IBM DevOps Deploy (8.0-8.2.1.0) exposes credentials and configuration data to any authenticated low-privilege user via API responses. The exposed secrets can serve as a direct launchpad for privilege escalation or lateral movement within the CI/CD pipeline and connected deployment targets. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS-assigned high confidentiality impact reflects real post-authentication risk.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 allows an authenticated low-privileged user to crash or hang the database server by submitting a crafted SQL query exploiting improper neutralization of special elements in XMLTable-derived column processing logic. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms this is remotely triggerable with minimal privileges, posing a realistic insider-threat or compromised-credential availability risk. No public exploit code or active exploitation has been identified at time of analysis.
Client-side enforcement of server-side security in IBM watsonx.data Intelligence versions 5.2.0 through 5.3.0 allows an authenticated low-privileged user to bypass access controls and perform actions beyond their authorized role. The root cause (CWE-602) means security decisions are made in client-side logic rather than enforced on the server, enabling bypass via crafted API requests. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, the high integrity impact (CVSS I:H) with low attack complexity poses meaningful risk in multi-tenant or role-segregated deployments.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.9.3 allows a low-privileged authenticated user to coerce the server into making attacker-controlled internal requests by abusing the URL data-source component, where a Time-of-Check/Time-of-Use race condition lets a hostname resolve to a safe address during validation and a private/internal address at fetch time (classic DNS rebinding). Exploitation is rated CVSS 7.1 with a scope change, reflecting that the server can be made to reach internal services beyond its own trust boundary; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.4 expose sensitive information through internal monitoring and event tables to authenticated low-privilege local users, a consequence of CWE-538 where sensitive data is inserted into storage locations accessible beyond the intended trust boundary. The CVSS vector confirms local-only attack surface (AV:L) with low-privilege authentication (PR:L) and high confidentiality impact, making this most relevant to insider threat scenarios or post-compromise lateral movement in multi-tenant Db2 environments. No public exploit code exists and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
IBM watsonx.data Intelligence versions 5.2.0 through 5.3.0 leak sensitive technical information to the browser via verbose error messages, giving authenticated remote attackers a reconnaissance foothold for follow-on attacks. The flaw is rooted in CWE-209 (overly informative error generation), which can expose stack traces, internal paths, backend technology details, or configuration fragments depending on what error condition is triggered. No public exploit code has been identified and no active exploitation is confirmed; the mandatory authentication barrier (PR:L) and information-only impact limit immediate blast radius, but the data gathered can materially assist more sophisticated attacks against the same system.
IBM watsonx.data Intelligence versions 5.2.0 through 5.3.0 exposes authenticated users to unauthorized action execution due to improper enforcement of behavioral workflow sequences (CWE-841). Low-privileged authenticated users can circumvent intended access controls by exploiting gaps in workflow state validation, enabling integrity-impacting operations they should not be permitted to perform. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, though the network-accessible attack vector and low complexity lower the bar for exploitation by any credentialed user.
Cleartext transmission in IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 exposes sensitive data to interception by network-adjacent attackers using man-in-the-middle techniques. The CVSS vector (AV:N/AC:H/PR:N) confirms exploitation requires no authentication but does demand the attacker occupy a privileged on-path network position, moderating the overall risk. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patch is available.
Session hijacking in IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 allows an authenticated user to impersonate another user because session IDs are not invalidated after they expire (CWE-613). An attacker who obtains or reuses a stale session identifier can act with the victim's identity, producing high confidentiality and integrity impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
File path control vulnerability (CWE-73) in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables a remote attacker to socially engineer a victim into triggering unauthorized file creation on the local system. Despite being tagged and described as SQL injection, the governing weakness classification is CWE-73 (External Control of File Name or Path), and the described impact - unexpected local file creation - aligns with that CWE rather than database injection. Affected versions span IBM ACE 12.x and 13.x across wide release ranges, as well as IBM Integration Bus for z/OS 10.1.x. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 allows adjacent unauthenticated attackers to crash the WebSphere Application Server JVM by sending malformed XDF-encoded Protocol Buffers messages to the data grid. The XDF decoder fails to enforce bounds on recursive protobuf message nesting depth and attacker-supplied length prefixes, triggering either a StackOverflowError or OutOfMemoryError that takes down the JVM process. No public exploit has been identified at time of analysis, and IBM has released a patch via their support advisory.
PowerPC 64-bit (ppc64le/Book3S64) Linux kernel systems from version 5.8 onward can be crashed via a local race condition between concurrent move_pages() and munmap() operations on Transparent Huge Page (THP) PMD-backed memory. During the PMD migration sequence, a narrow window exists where the PMD entry holds a migration swap entry with pmd_present=0; a concurrent munmap() acquiring the same page table lock during this window triggers a VM_BUG_ON() assertion in pmdp_huge_get_and_clear_full(), causing a kernel panic. No public exploit is identified and EPSS stands at 0.15% (5th percentile), but the DoS impact is confirmed by upstream kernel developers with real hardware traces on IBM POWER10 and is patched in stable releases 7.0.10 and 7.1.
Server-Side Request Forgery in IBM Watson Speech Services Cartridge (versions 4.0.0 through 5.3.1) lets an authenticated attacker coerce the system into issuing crafted requests to internal or external hosts, enabling internal network enumeration and pivoting toward follow-on attacks. The weakness lives in the embedded IBM Sterling File Gateway component used by the speech runtimes (GHSA-rr7j-v2q5-chgv). No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and CISA SSVC marks exploitation as none, so this is a patch-priority issue rather than an emergency.
IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.
Forced browsing exposure in IBM Datacap and IBM Datacap Navigator 9.1.7 through 9.1.9 allows a highly privileged local user to access application resources and functionality not surfaced in the UI by constructing direct URL requests, bypassing the intended UI-driven access control model. The impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability consequence, and no exploitation has been confirmed - no public exploit code exists and this CVE is absent from the CISA KEV catalog. IBM has released a patch addressing all affected versions.
Cross-site scripting in IBM Datacap and Datacap Navigator 9.1.7 through 9.1.9 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript within the Web UI, targeting authenticated users during active sessions. Successful exploitation can lead to credential theft or session hijacking by abusing the trust context of a legitimate user's browser. No public exploit code has been identified at time of analysis, and IBM has released a patch via official advisory.
Stored cross-site scripting in IBM TRIRIGA Application Platform 5.0.2 and 5.0.3 allows an authenticated low-privileged user to inject arbitrary JavaScript into the Web UI, which executes in the browser context of other users who view the affected page - enabling session hijacking and credential theft within trusted sessions. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support advisory. The CVSS score of 5.4 (Medium) reflects the authentication prerequisite and limited direct impact scope, though the credential disclosure risk elevates practical severity for privilege-escalation scenarios.
Stored cross-site scripting in IBM Engineering Workflow Management's Web UI enables an authenticated low-privileged attacker to inject arbitrary JavaScript that executes in the browser sessions of other users, including administrators, within the same trusted application context. Affected versions span 7.0.3 through 7.0.3 Interim Fix 020 and 7.1 through 7.1 Interim Fix 007. The scope-changed CVSS vector (S:C) confirms that impact crosses the attacker's own session boundary, creating a realistic path to credential theft or session hijacking against higher-privileged users. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Improper token validation in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data allows a privileged user to exceed their authorized scope, performing operations and accessing sensitive information beyond their granted permissions. Affected versions span 4.8 through 5.3, covering both the standard and warehouse variants of the product. No public exploit identified at time of analysis, and no active exploitation confirmed via CISA KEV, though the high integrity impact (I:H) signals meaningful risk for multi-tenant or regulated deployments.
IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.
Server-side request forgery in IBM Langflow Desktop 1.0.0 through 1.9.2 enables authenticated network-based attackers to coerce the application into issuing arbitrary outbound HTTP requests on their behalf. The vulnerability, classified under CWE-918, can expose internal network topology by proxying requests through the server to otherwise inaccessible hosts, and may serve as a stepping stone for further lateral movement or credential harvesting from cloud metadata services. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via IBM advisory.
HTTP header injection in IBM DevOps Plan 3.0.0 through 3.0.6 allows unauthenticated remote attackers to inject arbitrary HTTP headers by supplying a malicious HOST header value that the application fails to sanitize. The vulnerability (CWE-644) can be leveraged to mount cross-site scripting attacks against users, poison intermediate caches with attacker-controlled content, or hijack authenticated sessions. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the low-complexity, no-authentication-required attack surface makes this a meaningful risk for any internet-facing deployment.
Arbitrary file read in IBM's compliance-trestle Python library allows any file accessible to the running process to be extracted by supplying a malicious OSCAL profile YAML with path traversal sequences in the imports[].href field. Three confirmed attack vectors exist: via the trestle:// URI scheme, via relative href paths, and via back_matter rlinks - all exploiting the same root cause in LocalFetcher. Publicly available exploit code (PoC) exists demonstrating extraction of /etc/passwd, cloud credential files, and SSH private keys; no CISA KEV listing is confirmed at time of analysis.
Information disclosure in IBM Business Automation Workflow (containers and traditional deployments) exposes internal database schema details through application error messages to authenticated low-privilege users. Affecting versions across the 24.0.0, 24.0.1, 25.0.0, and 25.0.1 release lines, a network-accessible authenticated attacker can deliberately trigger error conditions to harvest database structure information - table names, column names, or schema layout - without needing elevated permissions. No public exploit code exists and no active exploitation is confirmed; SSVC assessment classifies this as non-automatable with partial technical impact, consistent with its limited confidentiality scope.
Path traversal in the asperahttpd HTTP component of IBM Aspera High-Speed Transfer Endpoint and Server (versions 3.7.4 through 4.4.7 Fix Pack 1) enables authenticated network users to read arbitrary files from the server's local filesystem beyond their authorized scope. The vulnerability is classified CWE-22 and carries a CVSS 6.5 medium score, reflecting high confidentiality impact with no integrity or availability exposure. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with partial technical impact, suggesting limited immediate threat despite the sensitive nature of file read primitives in a file-transfer product.
Credential exposure in IBM Guardium Data Protection's Long Term Retention (LTR) add-on feature allows authenticated network users to obtain sensitive credentials when the system is operating in debug mode. Affected versions are 12.2.1 (up to and including Fix Pack 4.4.7 Fix Pack 1) and 12.2.2. The high confidentiality impact (C:H) reflects that fully valid credentials - not just partial data - may be disclosed, potentially enabling lateral movement or privilege escalation within the data protection infrastructure. No public exploit has been identified at time of analysis, and SSVC assessment confirms no active exploitation.
Denial-of-service exposure in IBM OpenBMC firmware versions FW1110.00 through FW1110.11 allows unauthenticated remote attackers to partially degrade system availability by sending specially crafted network requests exploiting improper input quantity validation (CWE-1284). The attack requires no authentication, no user interaction, and low complexity, making it fully automatable per SSVC assessment - though no public exploit code has been identified at time of analysis. Because BMCs operate independently of the host OS and remain network-accessible even when servers are powered down, disrupting this layer carries operational risk disproportionate to the CVSS 5.3 Medium score alone.
Denial-of-service via uncontrolled recursion in the IBM i Integrated Language Environment (ILE) compiler affects versions 7.3, 7.4, 7.5 (≤12.1.4), and 7.6 (≤11.5.9). An authenticated network attacker can crash or hang the ILE compiler by submitting specially crafted source code containing a specific combination of statements that triggers infinite or deeply nested recursive processing. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low complexity and authenticated-only barrier makes this plausible for insider threat or compromised credential scenarios.
Denial of service in IBM Db2 11.5.x and 12.1.x allows a low-privileged local user to crash the database engine by executing a specially crafted query against range partitioned tables. The vulnerability stems from uncontrolled resource allocation (CWE-770) during query processing, resulting in complete availability loss with no impact to confidentiality or integrity. No public exploit code exists and this vulnerability has not been listed in the CISA KEV catalog at time of analysis.
Security bypass via race condition in IBM WebSphere Application Server Liberty 22.0.0.11 through 26.0.0.5 allows a remote, highly-privileged attacker to circumvent access controls during a narrow timing window, resulting in high-confidentiality-impact data exposure. The CVSS vector confirms network-based exploitation requiring high privileges and high attack complexity, constraining real-world risk significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive information disclosure in IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 exposes potentially sensitive data via log files accessible to local users. The CVSS vector (AV:L/PR:L) confirms exploitation requires local, low-privileged authenticated access, limiting the attack surface to users already present on the system. No public exploit has been identified and CISA SSVC rates exploitation as none, but the confidentiality impact is rated High, meaning successful access to log files could yield significant sensitive data.
OS command injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to disrupt system availability by submitting crafted input containing special elements that are improperly neutralized before being passed to OS-level commands. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms network-reachable exploitation requiring only low-privilege credentials, with high availability impact and a secondary low integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across actively supported IBM i releases make patching a priority for affected IBM Power Systems environments.
Parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to append unexpected parameters to system commands, with a vendor-confirmed availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) places this at Medium severity, requiring only valid credentials and network access with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
SQL parameter injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to bypass security restrictions by submitting specially crafted SQL input that is not properly neutralized before processing. The CWE-78 (OS Command Injection) classification combined with the SQL-parameter attack surface suggests that malicious input may propagate beyond the SQL layer to OS-level command execution, though the exact propagation path is not fully detailed in available data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
SQL injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to modify data in certain SQL tables by injecting malicious SQL commands through improperly neutralized input. The CVSS score of 4.3 (Medium) reflects a constrained impact profile - integrity in specific tables is at risk, but confidentiality and availability are unaffected. A vendor patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.
SQL injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to modify SQL table data by injecting unsanitized special elements into SQL commands processed by the platform. The CWE-89 root cause confirms missing or inadequate input neutralization within IBM i's SQL handling layer, enabling unauthorized data manipulation. No public exploit identified at time of analysis; a vendor patch is available via IBM advisory 7283289.
Path traversal in IBM i 7.3 through 7.6 exposes sensitive files to remote authenticated attackers by failing to enforce restricted directory boundaries. The vulnerability (CWE-22) allows a low-privileged authenticated user to escape intended directory scope and read arbitrary file system paths, resulting in high confidentiality impact with no integrity or availability effect. No public exploit code or CISA KEV listing has been identified at time of analysis.
Session token validation bypass in IBM i versions 7.3 through 7.6 enables a remote low-privileged attacker to circumvent security restrictions by exploiting improper session token handling (CWE-294). The CVSS vector confirms network reachability but mandates high attack complexity and an existing authenticated foothold, capping the score at 6.8 Medium. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has issued a vendor patch.
Remote authenticated exploitation of a race condition in IBM i 7.3 through 7.6 allows attackers with low-privilege credentials to obtain sensitive information and bypass platform security restrictions. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the flaw is reachable over the network without user interaction, though authentication is required. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via its support portal.
Stored cross-site scripting in IBM i versions 7.3 through 7.6 allows an authenticated low-privileged user to inject persistent JavaScript into the Web UI, executing it in other users' browser sessions within the same trusted environment. The Scope:Changed CVSS metric confirms the payload crosses session boundaries, enabling credential theft or session hijacking against other authenticated users. IBM has released a patch via advisory node/7283292; no public exploit code or active exploitation has been identified at time of analysis.
Security restriction bypass in IBM i 7.3 through 7.6 exploits an interpretation conflict in the multipart parser, enabling a remote attacker with high administrative privileges to circumvent configured access controls with low integrity impact. The flaw (CWE-436) arises when the security enforcement layer and the processing layer disagree on how to interpret multipart message boundaries, allowing carefully crafted requests to evade security checks. No public exploit code and no CISA KEV listing have been identified at time of analysis; IBM has released a patch via its support portal.
Path traversal in IBM i 7.3 through 7.6 enables remote authenticated attackers to read sensitive files outside authorized directory boundaries by supplying crafted path strings that the platform fails to properly validate (CWE-22). Impact is limited to confidentiality - no integrity or availability exposure - and exploitation requires prior authentication. A vendor-released patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.
Improper authorization in IBM i versions 7.3 through 7.6 allows remote authenticated attackers to bypass security restrictions and perform unauthorized write operations on protected objects or data. The flaw, rooted in CWE-285, requires only low-privilege credentials and no user interaction, making it accessible to any authenticated user on the platform. IBM has released patches via their support advisory, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege network attackers to inject directory traversal sequences into the username field, bypassing containment checks. Successful exploitation enables arbitrary directory deletion, cross-tenant data destruction, and deletion of JWT signing keys - the last of which forces platform-wide session invalidation for all users. No public exploit or CISA KEV listing has been identified at time of analysis, though the operational impact in multi-tenant deployments is severe despite the moderate CVSS score of 6.5.
Arbitrary file write via path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to create directories and write files to arbitrary locations on the server filesystem through the Knowledge Bases API. The flaw stems from unsanitized user-supplied knowledge base names being passed directly into file path construction, making exploitation straightforward once credentials are obtained. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Authenticated users in IBM Langflow OSS 1.0.0 through 1.10.3 can exploit a privileged built-in component to read arbitrary server-side environment variables, bypassing security controls designed to restrict custom component execution. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms this is a low-complexity, network-accessible flaw requiring only standard user credentials, with high confidentiality impact. No active exploitation confirmed via CISA KEV, and no public exploit code has been identified at time of analysis; IBM has released a patch via its support portal.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.3 allows low-privileged authenticated users to force the server to make arbitrary outbound HTTP requests to internal or restricted network destinations due to incomplete enforcement of the platform's built-in SSRF protections. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation at low complexity with high confidentiality impact, making cloud metadata endpoints and internal services realistic targets. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
Path traversal in IBM Langflow OSS 1.0.0-1.10.3 exposes arbitrary server filesystem files via a crafted MCP `resources/read` request using URL-encoded traversal sequences. Authenticated low-privilege users can read other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables - leaking the JWT secret effectively enables token forgery and full account takeover beyond what the CVSS 6.5 score implies. No public exploit identified at time of analysis; vendor patch is available per IBM advisory.
IBM Maximo Application Suite 9.0, 9.1, and 9.2 fails to set the `Secure` attribute on authorization tokens and session cookies, enabling interception of credential material over unencrypted HTTP. An attacker who tricks an authenticated user into following an HTTP link - via phishing or a malicious page - causes the victim's browser to transmit the session cookie in plaintext, where it can be captured by a server the attacker controls or via network sniffing. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, session token theft can lead to full account takeover, meaningfully exceeding the limited confidentiality scope implied by the raw CVSS score.
Session data tampering in IBM Maximo Application Suite 9.0, 9.1, and 9.2 is possible because the application signs session tokens with a weak HMAC secret, classified under CWE-330 (Use of Insufficiently Random Values). A remote unauthenticated attacker who can derive or predict the HMAC signing key may forge or modify session tokens, undermining session integrity across affected deployments. No public exploit code has been identified, this vulnerability is not listed in the CISA KEV catalog, and a vendor patch is available via IBM's advisory.
Improper TLS hostname verification in IBM Business Automation Workflow exposes high-privilege sessions to man-in-the-middle interception by failing to validate that server certificates match the target hostname. Affected deployments span both containerized (Kubernetes/OpenShift) and traditional on-premises models across multiple release trains from 24.0.0 through 26.0.0. No public exploit has been identified and the vulnerability is not listed in CISA KEV; real-world risk is substantially bounded by the PR:H requirement - an attacker must already hold administrative credentials before exploitation is feasible.
Unauthenticated remote information disclosure in IBM Cloud Pak for Business Automation 24.0.0 through 26.0.0 allows network attackers to retrieve sensitive data embedded in externally accessible manifest files. The vulnerability stems from CWE-538, where sensitive configuration or operational data is written into manifest files that are not adequately protected from external access. No public exploit has been identified at time of analysis, and a vendor patch is available via IBM's support portal.
Plugin output logs in IBM UrbanCode Deploy and IBM DevOps Deploy expose sensitive step values to any authenticated user with log access, across a wide range of actively-maintained versions spanning both product lines. The CVSS PR:L vector confirms that a low-privileged authenticated user - such as a developer or operator - who can view deployment logs may read sensitive values such as credentials, API tokens, or configuration secrets that plugin steps emit without redaction. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is practically elevated in CI/CD environments where plugin steps routinely handle high-value secrets.
XML External Entity injection in IBM DataPower Gateway 10.5.0, 10.6.0, and 10.6CD allows a privileged authenticated user who can submit XML data to the gateway to either exfiltrate sensitive information from the underlying system or trigger memory exhaustion through recursive or large entity expansion. The vulnerability exists in the gateway's XML processing pipeline, a core function of this API/ESB platform. No public exploit code has been identified at time of analysis, and the vendor has released a patch documented in IBM Security Advisory 7278748.
Cross-site scripting in IBM Engineering Requirements Management DOORS Web Access allows unauthenticated remote attackers to inject arbitrary JavaScript into the Web UI by tricking an authenticated user into interacting with a malicious payload, potentially resulting in credential disclosure within a trusted session. Affected versions span two maintained branches: 9.7.2.1-9.7.2.11 and 9.6.1.1-9.6.1.13. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and IBM has released a patch via advisory 7279145.
Denial of service in IBM Db2 federated server (versions 12.1.0 through 12.1.4) can be triggered by executing non-fenced federated queries, causing the database engine to exhaust resources and become unresponsive. The root cause is CWE-400 (Uncontrolled Resource Consumption) within the in-process federated wrapper execution path. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Cross-site scripting in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.2.0-6.2.2.0_1 enables any authenticated low-privilege user to inject persistent JavaScript into the Web UI, which executes within the browser session of other authenticated users who load the affected page. The changed scope (S:C in CVSS) reflects that the injected script runs in the victim's browser context rather than the originating user's, enabling credential harvesting or session token theft within the trusted application session. No public exploit code or CISA KEV listing exists at time of analysis; IBM has issued a patch.
Cross-site scripting in the Ebics server component of IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privileged users to inject arbitrary JavaScript into the Web UI, executing in the browser context of other users within a trusted session. Both products across four version branches (6.1.2.x, 6.2.0.x, 6.2.1.x, and 6.2.2.0) are affected, with the primary risk being credential disclosure or session hijacking of higher-privileged users including administrators. IBM has released a patch; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in the Administrative Console of IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server allows an authenticated low-privileged user to inject malicious JavaScript that executes in the browser of other users who view the affected console page. The CVSS scope change (S:C) confirms the attack crosses security boundaries, enabling impact on sessions belonging to higher-privileged administrators. No active exploitation has been identified; no public POC is known at time of analysis.
Cross-site scripting in IBM WebSphere Application Server traditional 8.5 and 9.0 allows remote attackers to inject arbitrary JavaScript or HTML via reflected input. A crafted link clicked by an authenticated user can execute scripts in the victim's browser, leading to session hijacking or credential theft. No active exploitation or public exploit code is currently known, and a vendor patch is available.
Information disclosure in the dashboard component of IBM Sterling B2B Integrator and File Gateway 6.2.x allows low‑privileged authenticated users to view sensitive details embedded in source code comments. No active exploitation or public proof‑of‑concept code is known at this time; the advisory carries a CVSS base score of 4.3 and is categorized as low severity.
Information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.x allows authenticated remote attackers to view sensitive data embedded in source code comments of a mailbox component. Affected versions include 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation has been reported.
Information disclosure in IBM Sterling B2B Integrator and File Gateway 6.2.x allows authenticated privileged users to read sensitive data from application log files. No public exploit code or active exploitation has been identified at time of analysis.
Denial of service in IBM WebSphere Liberty 17.0.0.3 through 26.0.0.8 when the restConnector-2.0 feature is enabled, allowing authenticated remote attackers with low privileges to exhaust server resources via uncontrolled recursion (CWE-674). The attack does not require user interaction and can be conducted over the network, resulting in high availability impact and potential partial confidentiality disclosure. No public exploit or active exploitation has been confirmed at time of analysis.
Improper TLS certificate validation in IBM TS4500 CLI tool versions 0.1.31 through 1.12.0.0 allows man-in-the-middle attackers to obtain sensitive information. The attack is remotely exploitable with high complexity but requires no authentication or user interaction. No public exploit or active exploitation has been identified at the time of analysis.
Physical access to IBM PowerVM Hypervisor firmware with Transparent Memory Encryption (TME) enabled can allow an attacker to decrypt protected memory contents due to insufficient entropy. This information disclosure vulnerability affects firmware versions FW1110.00–FW1110.20 and FW1060.00–FW1060.71, potentially exposing sensitive data stored in memory. No public exploit code or active exploitation evidence is available at the time of analysis.
Improper access control in IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privilege users to view sensitive data restricted to privileged users. The vulnerability has a CVSS 3.1 base score of 4.3 (low severity) and affects specific version ranges of both products. No public exploit or active exploitation has been identified, and IBM has released a patch.
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.
Stored cross-site scripting in IBM Sterling B2B Integrator and File Gateway allows privileged users to inject arbitrary JavaScript into the Web UI, altering intended functionality and potentially leading to credential disclosure within trusted sessions. No public exploit identified at time of analysis.
Unauthenticated information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway allows remote attackers to read sensitive data by sending a specially crafted HTTP request that bypasses authentication controls. Affected deployments span versions 6.2.0.0 through 6.2.2.0_1 across both products, covering a wide span of the 6.2.x release train. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch and published an advisory.
Cross-site scripting in IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 enables remote attackers to inject and execute arbitrary script code within a victim's browser session through unsanitized input that is rendered during web page generation. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms remote, unauthenticated exploitability contingent on victim interaction, consistent with reflected or stored XSS. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via its support portal.
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 expose an open redirect flaw (CWE-601) that enables remote attackers to silently redirect authenticated or unauthenticated users to arbitrary attacker-controlled websites by supplying a crafted URL. The vulnerability requires no privileges but does require user interaction, making it a phishing-enablement risk rather than a direct system compromise vector. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7279964.
Race condition in IBM Cognos Analytics 12.1.3 (builds through 12.1.3-2606251736) allows authenticated users to obtain incorrect report summary results belonging to other users or trigger report-processing failures by exploiting improper synchronization in the Agentic AI assistant's concurrent request-handling logic. The flaw requires authenticated access and concurrent user activity, limiting opportunistic exploitation, though in high-concurrency enterprise deployments the race window may be reliably triggered. No public exploit code or active exploitation has been identified; a vendor patch is available.
IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorrect authorization flaw (CWE-863) that allows an authenticated attacker with read-only privileges to perform unauthorized modifications and deployments outside their assigned permission scope. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective Container variants. A vendor patch is available per IBM advisory 7279510; no public exploit code or CISA KEV listing has been identified at time of analysis.
Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attackers to craft malicious URLs that redirect victims to arbitrary attacker-controlled websites, enabling phishing campaigns that exploit the trusted reputation of enterprise IAM infrastructure. Affected deployments span both on-premises and containerized editions across IBM Verify Identity Access 11.0-11.0.2 and IBM Security Verify Access 10.0-10.0.9.1. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7279510.
Server-side request forgery in IBM Langflow OSS (versions 1.0.0 through 1.10.0, and Langflow 1.9.0) allows an authenticated low-privileged user to coerce the server into making attacker-controlled outbound requests, reaching internal services and exfiltrating their responses. The flaw stems from an insecure default configuration combined with incomplete enforcement of the built-in SSRF protection, meaning the safeguard can be bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.
Denial of service in IBM Db2 11.5.x and 12.1.x allows a local database user to crash the database engine by submitting specially crafted SQL statements containing subqueries that trigger an infinite loop (CWE-835) in the query compiler. The vulnerability spans two active major release lines - 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 - covering a broad swath of IBM's current Db2 product lifecycle. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via the vendor advisory.
IBM Security Verify exposes sensitive internal information to unauthenticated remote attackers through overly detailed technical error messages rendered in the browser. Affected deployments span four product variants - IBM Verify Identity Access, IBM Security Verify Access, and their respective container editions - all of which share the same CWE-209 root cause. No public exploit code or CISA KEV listing exists at time of analysis; the primary risk is reconnaissance enablement, where leaked error details lower the effort required for subsequent, more severe attacks.
Stored/reflected cross-site scripting in the administrative console of IBM WebSphere Application Server 9.0 and 8.5 lets an adjacent-network attacker inject malicious script that executes in an administrator's browser session. Because the CVSS scope is changed and impact is rated high, a successful injection could let the attacker hijack the privileged admin session and pivot to broader server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Cleartext data transmission in IBM watsonx.data intelligence versions 5.2.2 through 5.3.1 (including patch-1) exposes sensitive information to network interception by a man-in-the-middle adversary. The platform transmits certain data without encryption, enabling an attacker positioned on the network path to capture confidential content in transit. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified; however, the CVSS High confidentiality impact (C:H) signals that the interceptable data is substantively sensitive, likely including queries, credentials, or intelligence payloads.
Temporary denial of service in IBM watsonx.data intelligence 5.2.0 through 5.3.0 is achievable by authenticated users who submit specially crafted HTTP requests, exploiting improper resource throttling allocation (CWE-770). The impact is limited to availability - confidentiality and integrity are unaffected - and the disruption is described as temporary rather than persistent. No public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting in IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 allows authenticated low-privileged users to inject persistent JavaScript into the Web UI, which then executes within the browser sessions of other authenticated users visiting the affected page. The CVSS scope change (S:C) confirms the payload crosses the security boundary from the attacker's session into victims' sessions, enabling credential harvesting within trusted contexts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored and persistent nature of the injection elevates operational impact beyond what the 6.4 base score alone conveys.
HTML injection in IBM watsonx.data Intelligence versions 5.2.0 through 5.3.0 enables a remote authenticated attacker to plant malicious HTML content that executes in a victim's browser within the hosting site's security context. The CVSS vector (PR:L/UI:R/C:H) confirms exploitation requires low-privilege authentication and a second user to view the injected content, with the primary impact being confidentiality loss - such as session token theft or credential harvesting. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; a vendor patch is available via IBM advisory 7277801.
Cross-site scripting in IBM watsonx.data Intelligence 5.2.0 through 5.3.0 allows low-privileged authenticated users to inject arbitrary JavaScript into the Web UI, enabling credential theft or session hijacking against higher-privileged victims. The CVSS scope change (S:C) confirms the injected script executes in the victim's browser context, crossing trust boundaries within the platform. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; IBM has released a patch via advisory PSIRT.
Server-side request forgery in IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 enables authenticated attackers to coerce the server into issuing arbitrary outbound HTTP requests to attacker-controlled destinations. The CVSS vector (PR:L) confirms exploitation requires a valid account, but no elevated privileges are needed beyond basic authentication. Primary impact is internal network enumeration and potential pivoting to services that trust the watsonx.data host, rather than direct data exfiltration. No public exploit code or CISA KEV listing has been identified at time of analysis.
Sensitive information disclosure in IBM UrbanCode Deploy and IBM DevOps Deploy exposes potentially sensitive data to any local user who can read application log files. Affected are UrbanCode Deploy 7.2 through 7.2.3.23 and 7.3 through 7.3.2.18, as well as DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the local no-privilege vector combined with high confidentiality impact makes this a meaningful insider threat and post-compromise escalation vector in enterprise CI/CD environments.
Sensitive configuration and secret disclosure in IBM UrbanCode Deploy (7.3-7.3.2.18) and IBM DevOps Deploy (8.0-8.2.1.0) exposes credentials and configuration data to any authenticated low-privilege user via API responses. The exposed secrets can serve as a direct launchpad for privilege escalation or lateral movement within the CI/CD pipeline and connected deployment targets. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS-assigned high confidentiality impact reflects real post-authentication risk.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.4 allows an authenticated low-privileged user to crash or hang the database server by submitting a crafted SQL query exploiting improper neutralization of special elements in XMLTable-derived column processing logic. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms this is remotely triggerable with minimal privileges, posing a realistic insider-threat or compromised-credential availability risk. No public exploit code or active exploitation has been identified at time of analysis.
Client-side enforcement of server-side security in IBM watsonx.data Intelligence versions 5.2.0 through 5.3.0 allows an authenticated low-privileged user to bypass access controls and perform actions beyond their authorized role. The root cause (CWE-602) means security decisions are made in client-side logic rather than enforced on the server, enabling bypass via crafted API requests. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog; however, the high integrity impact (CVSS I:H) with low attack complexity poses meaningful risk in multi-tenant or role-segregated deployments.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.9.3 allows a low-privileged authenticated user to coerce the server into making attacker-controlled internal requests by abusing the URL data-source component, where a Time-of-Check/Time-of-Use race condition lets a hostname resolve to a safe address during validation and a private/internal address at fetch time (classic DNS rebinding). Exploitation is rated CVSS 7.1 with a scope change, reflecting that the server can be made to reach internal services beyond its own trust boundary; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.4 expose sensitive information through internal monitoring and event tables to authenticated low-privilege local users, a consequence of CWE-538 where sensitive data is inserted into storage locations accessible beyond the intended trust boundary. The CVSS vector confirms local-only attack surface (AV:L) with low-privilege authentication (PR:L) and high confidentiality impact, making this most relevant to insider threat scenarios or post-compromise lateral movement in multi-tenant Db2 environments. No public exploit code exists and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
IBM watsonx.data Intelligence versions 5.2.0 through 5.3.0 leak sensitive technical information to the browser via verbose error messages, giving authenticated remote attackers a reconnaissance foothold for follow-on attacks. The flaw is rooted in CWE-209 (overly informative error generation), which can expose stack traces, internal paths, backend technology details, or configuration fragments depending on what error condition is triggered. No public exploit code has been identified and no active exploitation is confirmed; the mandatory authentication barrier (PR:L) and information-only impact limit immediate blast radius, but the data gathered can materially assist more sophisticated attacks against the same system.
IBM watsonx.data Intelligence versions 5.2.0 through 5.3.0 exposes authenticated users to unauthorized action execution due to improper enforcement of behavioral workflow sequences (CWE-841). Low-privileged authenticated users can circumvent intended access controls by exploiting gaps in workflow state validation, enabling integrity-impacting operations they should not be permitted to perform. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, though the network-accessible attack vector and low complexity lower the bar for exploitation by any credentialed user.
Cleartext transmission in IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 exposes sensitive data to interception by network-adjacent attackers using man-in-the-middle techniques. The CVSS vector (AV:N/AC:H/PR:N) confirms exploitation requires no authentication but does demand the attacker occupy a privileged on-path network position, moderating the overall risk. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patch is available.
Session hijacking in IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 allows an authenticated user to impersonate another user because session IDs are not invalidated after they expire (CWE-613). An attacker who obtains or reuses a stale session identifier can act with the victim's identity, producing high confidentiality and integrity impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
File path control vulnerability (CWE-73) in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables a remote attacker to socially engineer a victim into triggering unauthorized file creation on the local system. Despite being tagged and described as SQL injection, the governing weakness classification is CWE-73 (External Control of File Name or Path), and the described impact - unexpected local file creation - aligns with that CWE rather than database injection. Affected versions span IBM ACE 12.x and 13.x across wide release ranges, as well as IBM Integration Bus for z/OS 10.1.x. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial of service in IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 allows adjacent unauthenticated attackers to crash the WebSphere Application Server JVM by sending malformed XDF-encoded Protocol Buffers messages to the data grid. The XDF decoder fails to enforce bounds on recursive protobuf message nesting depth and attacker-supplied length prefixes, triggering either a StackOverflowError or OutOfMemoryError that takes down the JVM process. No public exploit has been identified at time of analysis, and IBM has released a patch via their support advisory.
PowerPC 64-bit (ppc64le/Book3S64) Linux kernel systems from version 5.8 onward can be crashed via a local race condition between concurrent move_pages() and munmap() operations on Transparent Huge Page (THP) PMD-backed memory. During the PMD migration sequence, a narrow window exists where the PMD entry holds a migration swap entry with pmd_present=0; a concurrent munmap() acquiring the same page table lock during this window triggers a VM_BUG_ON() assertion in pmdp_huge_get_and_clear_full(), causing a kernel panic. No public exploit is identified and EPSS stands at 0.15% (5th percentile), but the DoS impact is confirmed by upstream kernel developers with real hardware traces on IBM POWER10 and is patched in stable releases 7.0.10 and 7.1.
Server-Side Request Forgery in IBM Watson Speech Services Cartridge (versions 4.0.0 through 5.3.1) lets an authenticated attacker coerce the system into issuing crafted requests to internal or external hosts, enabling internal network enumeration and pivoting toward follow-on attacks. The weakness lives in the embedded IBM Sterling File Gateway component used by the speech runtimes (GHSA-rr7j-v2q5-chgv). No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and CISA SSVC marks exploitation as none, so this is a patch-priority issue rather than an emergency.
IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.
Forced browsing exposure in IBM Datacap and IBM Datacap Navigator 9.1.7 through 9.1.9 allows a highly privileged local user to access application resources and functionality not surfaced in the UI by constructing direct URL requests, bypassing the intended UI-driven access control model. The impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability consequence, and no exploitation has been confirmed - no public exploit code exists and this CVE is absent from the CISA KEV catalog. IBM has released a patch addressing all affected versions.
Cross-site scripting in IBM Datacap and Datacap Navigator 9.1.7 through 9.1.9 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript within the Web UI, targeting authenticated users during active sessions. Successful exploitation can lead to credential theft or session hijacking by abusing the trust context of a legitimate user's browser. No public exploit code has been identified at time of analysis, and IBM has released a patch via official advisory.
Stored cross-site scripting in IBM TRIRIGA Application Platform 5.0.2 and 5.0.3 allows an authenticated low-privileged user to inject arbitrary JavaScript into the Web UI, which executes in the browser context of other users who view the affected page - enabling session hijacking and credential theft within trusted sessions. No public exploit code has been identified at time of analysis, and IBM has released a patch via their support advisory. The CVSS score of 5.4 (Medium) reflects the authentication prerequisite and limited direct impact scope, though the credential disclosure risk elevates practical severity for privilege-escalation scenarios.
Stored cross-site scripting in IBM Engineering Workflow Management's Web UI enables an authenticated low-privileged attacker to inject arbitrary JavaScript that executes in the browser sessions of other users, including administrators, within the same trusted application context. Affected versions span 7.0.3 through 7.0.3 Interim Fix 020 and 7.1 through 7.1 Interim Fix 007. The scope-changed CVSS vector (S:C) confirms that impact crosses the attacker's own session boundary, creating a realistic path to credential theft or session hijacking against higher-privileged users. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Improper token validation in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data allows a privileged user to exceed their authorized scope, performing operations and accessing sensitive information beyond their granted permissions. Affected versions span 4.8 through 5.3, covering both the standard and warehouse variants of the product. No public exploit identified at time of analysis, and no active exploitation confirmed via CISA KEV, though the high integrity impact (I:H) signals meaningful risk for multi-tenant or regulated deployments.
IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8,5.0,5.1,5.2,5.3 could allow an authenticated user to cause a denial of service when creating new databases due to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.
Server-side request forgery in IBM Langflow Desktop 1.0.0 through 1.9.2 enables authenticated network-based attackers to coerce the application into issuing arbitrary outbound HTTP requests on their behalf. The vulnerability, classified under CWE-918, can expose internal network topology by proxying requests through the server to otherwise inaccessible hosts, and may serve as a stepping stone for further lateral movement or credential harvesting from cloud metadata services. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via IBM advisory.
HTTP header injection in IBM DevOps Plan 3.0.0 through 3.0.6 allows unauthenticated remote attackers to inject arbitrary HTTP headers by supplying a malicious HOST header value that the application fails to sanitize. The vulnerability (CWE-644) can be leveraged to mount cross-site scripting attacks against users, poison intermediate caches with attacker-controlled content, or hijack authenticated sessions. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the low-complexity, no-authentication-required attack surface makes this a meaningful risk for any internet-facing deployment.
Arbitrary file read in IBM's compliance-trestle Python library allows any file accessible to the running process to be extracted by supplying a malicious OSCAL profile YAML with path traversal sequences in the imports[].href field. Three confirmed attack vectors exist: via the trestle:// URI scheme, via relative href paths, and via back_matter rlinks - all exploiting the same root cause in LocalFetcher. Publicly available exploit code (PoC) exists demonstrating extraction of /etc/passwd, cloud credential files, and SSH private keys; no CISA KEV listing is confirmed at time of analysis.
Information disclosure in IBM Business Automation Workflow (containers and traditional deployments) exposes internal database schema details through application error messages to authenticated low-privilege users. Affecting versions across the 24.0.0, 24.0.1, 25.0.0, and 25.0.1 release lines, a network-accessible authenticated attacker can deliberately trigger error conditions to harvest database structure information - table names, column names, or schema layout - without needing elevated permissions. No public exploit code exists and no active exploitation is confirmed; SSVC assessment classifies this as non-automatable with partial technical impact, consistent with its limited confidentiality scope.
Path traversal in the asperahttpd HTTP component of IBM Aspera High-Speed Transfer Endpoint and Server (versions 3.7.4 through 4.4.7 Fix Pack 1) enables authenticated network users to read arbitrary files from the server's local filesystem beyond their authorized scope. The vulnerability is classified CWE-22 and carries a CVSS 6.5 medium score, reflecting high confidentiality impact with no integrity or availability exposure. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with partial technical impact, suggesting limited immediate threat despite the sensitive nature of file read primitives in a file-transfer product.
Credential exposure in IBM Guardium Data Protection's Long Term Retention (LTR) add-on feature allows authenticated network users to obtain sensitive credentials when the system is operating in debug mode. Affected versions are 12.2.1 (up to and including Fix Pack 4.4.7 Fix Pack 1) and 12.2.2. The high confidentiality impact (C:H) reflects that fully valid credentials - not just partial data - may be disclosed, potentially enabling lateral movement or privilege escalation within the data protection infrastructure. No public exploit has been identified at time of analysis, and SSVC assessment confirms no active exploitation.
Denial-of-service exposure in IBM OpenBMC firmware versions FW1110.00 through FW1110.11 allows unauthenticated remote attackers to partially degrade system availability by sending specially crafted network requests exploiting improper input quantity validation (CWE-1284). The attack requires no authentication, no user interaction, and low complexity, making it fully automatable per SSVC assessment - though no public exploit code has been identified at time of analysis. Because BMCs operate independently of the host OS and remain network-accessible even when servers are powered down, disrupting this layer carries operational risk disproportionate to the CVSS 5.3 Medium score alone.
Denial-of-service via uncontrolled recursion in the IBM i Integrated Language Environment (ILE) compiler affects versions 7.3, 7.4, 7.5 (≤12.1.4), and 7.6 (≤11.5.9). An authenticated network attacker can crash or hang the ILE compiler by submitting specially crafted source code containing a specific combination of statements that triggers infinite or deeply nested recursive processing. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low complexity and authenticated-only barrier makes this plausible for insider threat or compromised credential scenarios.
Denial of service in IBM Db2 11.5.x and 12.1.x allows a low-privileged local user to crash the database engine by executing a specially crafted query against range partitioned tables. The vulnerability stems from uncontrolled resource allocation (CWE-770) during query processing, resulting in complete availability loss with no impact to confidentiality or integrity. No public exploit code exists and this vulnerability has not been listed in the CISA KEV catalog at time of analysis.
Security bypass via race condition in IBM WebSphere Application Server Liberty 22.0.0.11 through 26.0.0.5 allows a remote, highly-privileged attacker to circumvent access controls during a narrow timing window, resulting in high-confidentiality-impact data exposure. The CVSS vector confirms network-based exploitation requiring high privileges and high attack complexity, constraining real-world risk significantly. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Sensitive information disclosure in IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 exposes potentially sensitive data via log files accessible to local users. The CVSS vector (AV:L/PR:L) confirms exploitation requires local, low-privileged authenticated access, limiting the attack surface to users already present on the system. No public exploit has been identified and CISA SSVC rates exploitation as none, but the confidentiality impact is rated High, meaning successful access to log files could yield significant sensitive data.