IBM
Monthly
Db2 contains a vulnerability that allows attackers to cause a denial of service due to improper neutralization of special elements in (CVSS 6.5).
Db2 contains a vulnerability that allows attackers to a local user to cause a denial of service due to improper neutralization of spec (CVSS 6.5).
IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query. [CVSS 6.5 MEDIUM]
Db2 contains a vulnerability that allows attackers to a local user with filesystem access to escalate their privileges due to the use (CVSS 8.4).
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, which may trigger an unhandled exception leading to abnormal server termination. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key. [CVSS 6.8 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic. [CVSS 6.2 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level. [CVSS 7.2 HIGH]
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service when copying large table containing XML data due to improper allocation of system resources. [CVSS 6.2 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables. [CVSS 6.5 MEDIUM]
Db2 contains a vulnerability that allows attackers to an authenticated user to cause a denial of service due to excessive use of a glo (CVSS 6.5).
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query. [CVSS 6.5 MEDIUM]
IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system. [CVSS 5.3 MEDIUM]
Applinx versions up to 11.1.0 is affected by improper verification of cryptographic signature (CVSS 7.3).
IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. [CVSS 3.5 LOW]
Applinx versions up to 11.1.0 contains a vulnerability that allows attackers to an authenticated user to perform unauthorized administrative actions on the serv (CVSS 3.1).
IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. [CVSS 5.4 MEDIUM]
IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. [CVSS 6.4 MEDIUM]
IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. [CVSS 5.4 MEDIUM]
IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. [CVSS 5.4 MEDIUM]
Sterling Connect\ versions up to express_adapter_for_sterling_b2b_integrator is affected by session fixation (CVSS 6.3).
Sterling Connect\ versions up to express_adapter_for_sterling_b2b_integrator is affected by cross-site scripting (xss) (CVSS 5.4).
Sterling Connect\ versions up to express_adapter_for_sterling_b2b_integrator is affected by cross-site scripting (xss) (CVSS 6.1).
Sterling Connect\ versions up to express_adapter_for_sterling_b2b_integrator is affected by insufficient session expiration (CVSS 6.3).
Sterling Connect\ versions up to express_adapter_for_sterling_b2b_integrator is affected by insufficient session expiration (CVSS 6.3).
Business Automation Workflow versions up to 24.0.0 is affected by execution with unnecessary privileges (CVSS 4.7).
Business Automation Workflow versions up to 24.0.0 is affected by insertion of sensitive information into externally-accessible file (CVSS 5.5).
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
Concert versions up to 2.1.0 contains a vulnerability that allows attackers to a remote attacker to obtain sensitive information from allocated memory due to i (CVSS 5.9).
Concert versions up to 2.1.0 contains a vulnerability that allows attackers to a remote attacker to obtain sensitive information from allocated memory due to i (CVSS 5.9).
Direct for UNIX Container 6.3.0.0 versions up to 6.3.0.6 is affected by use of hard-coded credentials (CVSS 8.4).
Aspera Console versions up to 3.4.7 is affected by insertion of sensitive information into log file (CVSS 4.9).
IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image. [CVSS 8.4 HIGH]
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. [CVSS 2.9 LOW]
libxml2's xmlCatalogXMLResolveURI function is vulnerable to uncontrolled recursion when processing self-referencing delegate URI entries in XML catalogs, allowing remote attackers to trigger stack exhaustion and crash applications. This configuration-dependent denial of service requires specially crafted XML input but no authentication, affecting any application using the vulnerable library to parse untrusted catalogs. No patch is currently available.
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. [CVSS 3.7 LOW]
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: change all pageblocks migrate type on coalescing When a page is freed it coalesces with a buddy into a higher order page while possible.
Local privilege escalation in IBM Concert 1.0.0 through 2.1.0 lets an attacker who already has a foothold on the host win a symbolic-link race condition (CWE-367 TOCTOU) against a privileged Concert file operation and gain high-integrity read/write/execute capability as the service account, scored CVSS 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector is local-only with high attack complexity, so success hinges on precisely timing the symlink swap between the check and the use - often requiring repeated attempts - while no victim interaction is needed. No public exploit identified at time of analysis, there is no CISA KEV listing, and the issue is best treated as a real-but-low-priority local hardening problem pending an IBM fix.
HTML injection in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.14.1) allows an authenticated, low-privileged user to plant attacker-controlled HTML that is later rendered in a second victim's browser within the security context of the Faspex site. The triggering user must hold a valid Faspex account and must persuade or induce another user to view the affected content, and the impact stays confined to that victim's browsing session on the Faspex origin rather than the server itself. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); with a CVSS 3.1 base score of 5.4, this is a moderate-severity, social-engineering-dependent issue rather than a mass-exploitation emergency.
Authenticated users of IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.14.1) can enumerate package identifiers to expose sensitive information about data packages they should not have visibility into. The flaw requires a valid low-privilege Faspex account and network access to the web application or API (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3), so it is not exploitable without credentials and impact is limited to confidentiality - no integrity or availability effect. With no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), this is a low-to-moderate priority issue best addressed by upgrading and tightening package-level authorization, with risk scaling on multi-tenant instances that host many users' packages.
Authenticated users of IBM Aspera Faspex 5 can access backend API features that are disabled in the web interface due to inconsistent permission enforcement (CWE-279), potentially leading to misuse of those features. Affected versions are 5.0.0 through 5.0.14.1. Exploitation requires a valid session and does not involve user interaction; impact is limited to low confidentiality and integrity effects, and no public exploit or active exploitation has been identified. This is assessed as a low-severity, low-priority access-control weakness.
IBM DS8000 enterprise storage arrays - DS8A00 (R10.0/R10.1) and DS8900F (R9.4) - expose immutable backup infrastructure to destruction by local users holding authorized CCW update permissions, due to missing authorization checks in IBM Safeguarded Copy and GDPS Logical corruption protection mechanisms. The flaw (CWE-862) allows a low-privileged operator to delete or corrupt protected backup snapshots that are specifically designed to survive ransomware and insider attacks. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the strategic risk in ransomware pre-staging scenarios is significant.
Authenticated low-privileged users of IBM Db2 Intelligence Center 1.1.0, 1.1.1, and 1.1.2 can perform unauthorized server-side actions by circumventing security checks that are enforced only in the client, allowing integrity-impacting operations the user should not be permitted to run. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning it requires a valid account, yields no data disclosure or denial of service, but can corrupt or alter state; there is no public exploit identified at time of analysis and EPSS is low at 0.21% (10th percentile). This is best characterized as a moderate-risk authorization-bypass issue affecting authenticated insiders or credential-holders rather than an unauthenticated remote threat.
Authentication bypass in IBM API Connect 10.0.8.0 through 10.0.8.5 and 10.0.11.0 allows remote, unauthenticated attackers to gain unauthorized access with full confidentiality, integrity, and availability impact, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is a CWE-305 primary authentication weakness that requires only network reachability to the affected management or gateway interface, with no user interaction or special conditions. No public exploit code has been identified at time of analysis, and no KEV entry is present; affected organizations should refer to IBM's advisory at https://www.ibm.com/support/pages/node/7255149 for mitigation guidance.
IBM Concert 1.0.0 through 2.1.0 can disclose residual heap memory contents to remote, unauthenticated users because server-side buffers are not properly cleared before release (CWE-244). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, confidentiality-only flaw that requires no credentials or user interaction, but the leak is opportunistic and non-deterministic - an attacker cannot direct which memory contents are returned, and the specific feature, protocol, or endpoint that echoes the leaked memory is not named in the available data. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is governed largely by whether the affected interface is actually reachable (internal-only deployments and access restrictions materially reduce exposure).
Local code execution in IBM Concert 1.0.0 through 2.1.0 allows an authenticated attacker to overflow a stack buffer and run arbitrary code with the privileges of the vulnerable service. The flaw, caused by improper bounds checking (CWE-119), requires a local account (PR:L) but no victim interaction (UI:N). No public exploit code or active exploitation has been identified at time of analysis.
IBM Concert 1.0.0 through 2.1.0 stores sensitive information - such as credentials and secrets handled during recursive Docker builds - in cleartext on disk, allowing a local user with access to the build host to read and disclose it. The issue is purely a confidentiality exposure (C:H with I:N/A:N, CVSS 6.2) and requires local access to the host where recursive builds run, with PR:N and UI:N in the assessed vector; there is no public exploit identified at time of analysis, and EPSS is very low at 0.10% (1st percentile). Real-world risk is best characterized as low and depends heavily on how many local accounts can reach the build environment and its artifacts.
IBM UrbanCode Deploy (7.1 through 7.1.2.27, 7.2 through 7.2.3.20, 7.3 through 7.3.2.15) and IBM DevOps Deploy (8.0 through 8.0.1.10, 8.1 through 8.1.2.3) can briefly honor an existing http-session from a new client IP address because the client-IP binding enforcement is subject to a race condition, so a replayed or stolen session may be accepted for a short interval before the server invalidates it. Successful abuse requires an already-authenticated session identifier that the attacker possesses or can replay (CVSS PR:L), and the attacker must land inside a narrow timing window from a different IP address - conditions reflected in AC:H and the low 5.0 base score. There is no public exploit identified at time of analysis and EPSS is low at 0.19% (8th percentile), so this is a low-to-moderate priority hardening issue rather than an urgent, mass-exploitable flaw; exposure is limited to transient, probabilistic unauthorized access under specific network conditions.
In IBM DevOps Deploy 8.1 through 8.1.2.3, an authenticated user who holds LLM integration configuration privileges can recover a previously saved LLM API token - meaning a secret that is supposed to be write-only after storage can be read back out of the product. Exploitation is not reachable by unauthenticated or ordinary low-privileged users: it requires a valid session plus a specific administrative capability, and it only yields anything if an LLM integration has already been configured with a stored token, making it primarily an insider-abuse or post-compromise credential-recovery issue. There is no public exploit identified at time of analysis, EPSS is only 0.30% (21st percentile), and the flaw is confined to confidentiality of the stored token with no integrity or availability impact.
IBM DevOps Deploy versions 8.1 through 8.1.2.3 transmit data over an unencrypted channel, enabling a man-in-the-middle attacker to capture sensitive information. Exploitation requires the attacker to already occupy a privileged network position between components (high complexity, AC:H), and no authentication or user interaction is needed (PR:N/UI:N). With a low EPSS score of 0.19% and no public exploit identified at time of analysis, this is a moderate-severity confidentiality-only issue (CVSS 5.9) rather than an urgent threat.
Out-of-bounds read in Eclipse OMR 0.7.0 and later can occur when the compiler optimization for Latin-compatible charset to IBM-1047/037 EBCDIC translation mishandles NUL (0x00) bytes on IBM Z (s390x). The output byte array is truncated at the first NUL, discarding it and subsequent characters, so downstream code may read beyond the intended buffer; impact is bounded to limited information disclosure and possible instability, not code execution. This affects Eclipse OpenJ9 consumers of OMR on Z processors, non-Z platforms are not exposed, no public exploit has been identified at time of analysis, and the vendor-released fix is Eclipse OMR 0.8.0. The CVSS vector indicates PR:N (unauthenticated), and overall priority is moderate given the specific platform, data, and NUL-byte prerequisites.
Authenticated users of IBM Aspera Orchestrator 4.0.0 through 4.1.0 can inject operating-system commands that the application then executes with elevated privileges, giving a low-privileged account full control over the host (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the CVSS vector carries PR:L, exploitation requires a valid login on the Orchestrator instance; the attacker does not need victim interaction and can reach the vulnerable component over the network, making this primarily a post-compromise or credentialed-insider escalation path rather than a mass internet-exploitation candidate. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.48% (39th percentile), so immediate broad scanning activity is not indicated, but the impact once credentials are in hand is complete compromise of confidentiality, integrity, and availability.
SQL injection in IBM Aspera Orchestrator 4.0.0 through 4.1.0 lets an authenticated attacker with low privileges send crafted SQL statements to view, add, modify, or delete data in the back-end database. The CVSS v3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning remote exploitation is possible after authentication but not by fully anonymous internet users. No public exploit has been identified at time of analysis, and EPSS is 0.36% (28th percentile), making this a credible but not emergency-level priority.
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to degrade or exhaust the product's email service by repeatedly triggering email-generating operations faster than the service can process them, because the application does not properly control interaction frequency (CWE-799). The defect is availability-only - there is no data disclosure or modification - and exploitation requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5), so remote unauthenticated attackers cannot trigger it. EPSS places it at roughly 0.36% (27th percentile) and no public exploit code has been identified; this is a moderate-severity issue that should be prioritized behind higher-impact findings.
IBM Aspera Orchestrator 4.0.0 through 4.1.0 allows an authenticated remote user to change another user's password without knowing the original password, leading to potential account takeover and integrity compromise. The flaw (CWE-620, Unverified Password Change) requires a valid low-privilege account but no user interaction; it is network-reachable with no special configuration. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.28%, though risk increases in environments with many provisioned users, shared accounts, or exposed self-service portals.
IBM Planning Analytics Local versions 2.1.0 through 2.1.15 disclose sensitive server architecture information to authenticated users, potentially aiding further attacks against the system. The vulnerability requires low-privilege network access (CVSS 4.3, Medium) and has a low EPSS score (0.21%, 11th percentile), indicating limited exploitation likelihood. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; it is considered a low-to-moderate priority that is not urgent.
IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.
A remote code execution vulnerability (CVSS 2.7) that allows a privileged user. Remediation should follow standard vulnerability management procedures.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks.
Server-side request forgery (SSRF) in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 allows an authenticated attacker with low privileges to send unauthorized requests from the server, potentially leading to network enumeration or facilitating other attacks. This moderate-severity issue (CVSS 4.3) is low-priority in practice because it requires valid credentials and only impacts confidentiality. No public exploit code or active exploitation has been identified, and EPSS is 0.07% (22nd percentile).
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.
Local privilege escalation in IBM Informix Dynamic Server 14.10 allows a user who already holds a low-privilege account on the database host to log into the Informix server as administrator without supplying a password, giving full control over the database engine and its data. The issue is strictly local - the assessed CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) requires pre-existing access to the host and no user interaction, so it is not remotely exploitable and cannot be triggered against a system the attacker cannot already log into. Risk signals point to a genuine but locally-scoped flaw rather than a remote emergency: EPSS is 0.02% (5th percentile), the CVE is not in CISA KEV, and no public exploit code has been identified at time of analysis.
IBM Sterling B2B Integrator and Sterling File Gateway (6.0.0.0-6.1.2.7, 6.2.0.0-6.2.0.5, and 6.2.1.1) ship a sensitive session cookie without a restrictive SameSite attribute, allowing cross-site requests to carry that cookie. Following our assessment, exploitation requires a logged-in victim to be lured into interacting with an attacker-controlled cross-origin page, so the vector realistically includes user interaction (UI:R) despite the published PR:N/UI:N score, and impact is confidentiality-only. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and EPSS is very low at 0.05% (16th percentile), so this is a genuine-but-moderate configuration weakness rather than an urgent threat.
IBM Concert 1.0.0 through 2.0.0 relies on weaker-than-expected cryptographic algorithms, permitting an attacker who already possesses data encrypted by the product to recover highly sensitive plaintext. Exploitation cannot be initiated by a remote network request against a default deployment: the attacker must first obtain the protected ciphertext through on-path interception, access to encrypted data at rest, or a prior compromise, which makes the vulnerability a weakness-amplifier rather than a standalone entry point. The CVSS base score is 7.5 (High) with a network vector, but the independent assessment raises attack complexity to High and the EPSS score is 0.02% (6th percentile), with no public exploit code and no CISA KEV listing - indicating a low-priority, low-real-risk issue in practice. Impact is limited to confidentiality.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could reveal sensitive server IP configuration information to an unauthorized. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable. No vendor patch available.
IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Concert 1.0.0 through 2.0.0 exposes sensitive server-side details through its HTTP response headers, letting remote attackers passively fingerprint the deployment - build/version banners, middleware or platform identifiers, and internal host or component names - and use that reconnaissance to plan follow-on attacks. The vendor scored this 7.5 (C:H), but the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, because the leak by itself grants no access, alters no data, and exposes no credentials; meaningful harm requires chaining with a separate vulnerability. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified, and EPSS is only 0.05% (16th percentile), so real-world priority is low despite the High headline score.
IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to improper neutralization of output. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Concert 1.0.0 through 2.0.0 could allow a local user with specific permission to obtain sensitive information from files due to uncontrolled recursive directory copying. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. No vendor patch available.
IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 are impacted by obtaining an information vulnerability in the database plan cache implementation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Storage Virtualize 8.4, 8.5, 8.7, and 9.1 IKEv1 implementation allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated remote command execution affects IBM AIX 7.2/7.3 and IBM VIOS 3.1/4.1 hosts that run the nimsh (NIM Service Handler) client service with its SSL/TLS implementation exposed to the network, letting a remote attacker execute arbitrary commands against the target (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The root cause is improper process control (CWE-114), and IBM describes this as addressing additional attack vectors beyond those previously fixed for CVE-2024-56347, so environments that only applied the earlier fix stay exposed. No public exploit code has been identified at time of analysis and EPSS is low (0.14%, 34th percentile), but probability rises sharply wherever nimsh is reachable on its service ports (typically 3901/3902) rather than restricted to a trusted NIM master or management network.
Unauthenticated remote command execution affects IBM AIX 7.2 and 7.3 and IBM VIOS 3.1 and 4.1 systems configured with the NIM server (NIM master) role, where the 'nimesis' service is network-reachable. The flaw stems from improper process controls (CWE-114), and IBM notes it covers additional attack vectors for a defect previously fixed under CVE-2024-56346 - so hosts patched only for that CVE remain exposed to these new vectors. All severity signals align on CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating complete confidentiality, integrity and availability impact with no authentication or user interaction required; EPSS is currently low at 0.21% (43rd percentile) and no public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in the IBM AIX and VIOS NIM server service (nimesis) allows remote, unauthenticated attackers to write arbitrary files on hosts configured as NIM masters. AIX 7.2/7.3 and VIOS 3.1/4.1 systems are in scope only when they run and expose nimesis; ordinary NIM clients do not expose this service and are not exploitable through this path. No public exploit code was identified at time of analysis and EPSS is low (0.11%, 29th percentile), but successful exploitation can compromise confidentiality and integrity, and the independent assessment also rates availability impact high.
IBM AIX 7.2/7.3 and IBM VIOS 3.1/4.1 store the private keys used by Network Installation Management (NIM) in a way that leaves them exposed to interception, so an attacker who can position themselves as a man-in-the-middle on the network path between a NIM master and its clients can capture those keys and use them to impersonate trusted NIM endpoints (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H). Only systems actually running NIM - and whose NIM traffic crosses an attacker-controllable network segment - are realistically exposed; the high attack complexity reflects that MITM prerequisite, not any mitigation inside the product. Exploitation has not been observed in the wild (not in CISA KEV) and no public exploit code was identified at time of analysis, with EPSS at roughly 0.09% (25th percentile), so this reads as a serious-but-not-urgent credential-exposure flaw rather than a mass-exploitation priority.
IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Db2 contains a vulnerability that allows attackers to cause a denial of service due to improper neutralization of special elements in (CVSS 6.5).
Db2 contains a vulnerability that allows attackers to a local user to cause a denial of service due to improper neutralization of spec (CVSS 6.5).
IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given specially crafted query. [CVSS 6.5 MEDIUM]
Db2 contains a vulnerability that allows attackers to a local user with filesystem access to escalate their privileges due to the use (CVSS 8.4).
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Object scalar function, which may trigger an unhandled exception leading to abnormal server termination. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage aliases could allow an authenticated user to execute unauthorized commands due to an authorization bypass vulnerability using a user-controlled key. [CVSS 6.8 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic. [CVSS 6.2 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level. [CVSS 7.2 HIGH]
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service when copying large table containing XML data due to improper allocation of system resources. [CVSS 6.2 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service due to improper allocation of resources. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur when selecting from certain types of tables. [CVSS 6.5 MEDIUM]
Db2 contains a vulnerability that allows attackers to an authenticated user to cause a denial of service due to excessive use of a glo (CVSS 6.5).
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of service using a specially crafted SQL statement including XML that performs uncontrolled recursion. [CVSS 6.5 MEDIUM]
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenticated user creates a specially crafted query. [CVSS 6.5 MEDIUM]
IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system. [CVSS 5.3 MEDIUM]
Applinx versions up to 11.1.0 is affected by improper verification of cryptographic signature (CVSS 7.3).
IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. [CVSS 3.5 LOW]
Applinx versions up to 11.1.0 contains a vulnerability that allows attackers to an authenticated user to perform unauthorized administrative actions on the serv (CVSS 3.1).
IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. [CVSS 5.4 MEDIUM]
IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. [CVSS 6.4 MEDIUM]
IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. [CVSS 5.4 MEDIUM]
IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. [CVSS 5.4 MEDIUM]
Sterling Connect\ versions up to express_adapter_for_sterling_b2b_integrator is affected by session fixation (CVSS 6.3).
Sterling Connect\ versions up to express_adapter_for_sterling_b2b_integrator is affected by cross-site scripting (xss) (CVSS 5.4).
Sterling Connect\ versions up to express_adapter_for_sterling_b2b_integrator is affected by cross-site scripting (xss) (CVSS 6.1).
Sterling Connect\ versions up to express_adapter_for_sterling_b2b_integrator is affected by insufficient session expiration (CVSS 6.3).
Sterling Connect\ versions up to express_adapter_for_sterling_b2b_integrator is affected by insufficient session expiration (CVSS 6.3).
Business Automation Workflow versions up to 24.0.0 is affected by execution with unnecessary privileges (CVSS 4.7).
Business Automation Workflow versions up to 24.0.0 is affected by insertion of sensitive information into externally-accessible file (CVSS 5.5).
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
Concert versions up to 2.1.0 contains a vulnerability that allows attackers to a remote attacker to obtain sensitive information from allocated memory due to i (CVSS 5.9).
Concert versions up to 2.1.0 contains a vulnerability that allows attackers to a remote attacker to obtain sensitive information from allocated memory due to i (CVSS 5.9).
Direct for UNIX Container 6.3.0.0 versions up to 6.3.0.6 is affected by use of hard-coded credentials (CVSS 8.4).
Aspera Console versions up to 3.4.7 is affected by insertion of sensitive information into log file (CVSS 4.9).
IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image. [CVSS 8.4 HIGH]
A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. [CVSS 2.9 LOW]
libxml2's xmlCatalogXMLResolveURI function is vulnerable to uncontrolled recursion when processing self-referencing delegate URI entries in XML catalogs, allowing remote attackers to trigger stack exhaustion and crash applications. This configuration-dependent denial of service requires specially crafted XML input but no authentication, affecting any application using the vulnerable library to parse untrusted catalogs. No patch is currently available.
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. [CVSS 3.7 LOW]
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: change all pageblocks migrate type on coalescing When a page is freed it coalesces with a buddy into a higher order page while possible.
Local privilege escalation in IBM Concert 1.0.0 through 2.1.0 lets an attacker who already has a foothold on the host win a symbolic-link race condition (CWE-367 TOCTOU) against a privileged Concert file operation and gain high-integrity read/write/execute capability as the service account, scored CVSS 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector is local-only with high attack complexity, so success hinges on precisely timing the symlink swap between the check and the use - often requiring repeated attempts - while no victim interaction is needed. No public exploit identified at time of analysis, there is no CISA KEV listing, and the issue is best treated as a real-but-low-priority local hardening problem pending an IBM fix.
HTML injection in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.14.1) allows an authenticated, low-privileged user to plant attacker-controlled HTML that is later rendered in a second victim's browser within the security context of the Faspex site. The triggering user must hold a valid Faspex account and must persuade or induce another user to view the affected content, and the impact stays confined to that victim's browsing session on the Faspex origin rather than the server itself. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); with a CVSS 3.1 base score of 5.4, this is a moderate-severity, social-engineering-dependent issue rather than a mass-exploitation emergency.
Authenticated users of IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.14.1) can enumerate package identifiers to expose sensitive information about data packages they should not have visibility into. The flaw requires a valid low-privilege Faspex account and network access to the web application or API (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3), so it is not exploitable without credentials and impact is limited to confidentiality - no integrity or availability effect. With no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), this is a low-to-moderate priority issue best addressed by upgrading and tightening package-level authorization, with risk scaling on multi-tenant instances that host many users' packages.
Authenticated users of IBM Aspera Faspex 5 can access backend API features that are disabled in the web interface due to inconsistent permission enforcement (CWE-279), potentially leading to misuse of those features. Affected versions are 5.0.0 through 5.0.14.1. Exploitation requires a valid session and does not involve user interaction; impact is limited to low confidentiality and integrity effects, and no public exploit or active exploitation has been identified. This is assessed as a low-severity, low-priority access-control weakness.
IBM DS8000 enterprise storage arrays - DS8A00 (R10.0/R10.1) and DS8900F (R9.4) - expose immutable backup infrastructure to destruction by local users holding authorized CCW update permissions, due to missing authorization checks in IBM Safeguarded Copy and GDPS Logical corruption protection mechanisms. The flaw (CWE-862) allows a low-privileged operator to delete or corrupt protected backup snapshots that are specifically designed to survive ransomware and insider attacks. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the strategic risk in ransomware pre-staging scenarios is significant.
Authenticated low-privileged users of IBM Db2 Intelligence Center 1.1.0, 1.1.1, and 1.1.2 can perform unauthorized server-side actions by circumventing security checks that are enforced only in the client, allowing integrity-impacting operations the user should not be permitted to run. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning it requires a valid account, yields no data disclosure or denial of service, but can corrupt or alter state; there is no public exploit identified at time of analysis and EPSS is low at 0.21% (10th percentile). This is best characterized as a moderate-risk authorization-bypass issue affecting authenticated insiders or credential-holders rather than an unauthenticated remote threat.
Authentication bypass in IBM API Connect 10.0.8.0 through 10.0.8.5 and 10.0.11.0 allows remote, unauthenticated attackers to gain unauthorized access with full confidentiality, integrity, and availability impact, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is a CWE-305 primary authentication weakness that requires only network reachability to the affected management or gateway interface, with no user interaction or special conditions. No public exploit code has been identified at time of analysis, and no KEV entry is present; affected organizations should refer to IBM's advisory at https://www.ibm.com/support/pages/node/7255149 for mitigation guidance.
IBM Concert 1.0.0 through 2.1.0 can disclose residual heap memory contents to remote, unauthenticated users because server-side buffers are not properly cleared before release (CWE-244). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, confidentiality-only flaw that requires no credentials or user interaction, but the leak is opportunistic and non-deterministic - an attacker cannot direct which memory contents are returned, and the specific feature, protocol, or endpoint that echoes the leaked memory is not named in the available data. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is governed largely by whether the affected interface is actually reachable (internal-only deployments and access restrictions materially reduce exposure).
Local code execution in IBM Concert 1.0.0 through 2.1.0 allows an authenticated attacker to overflow a stack buffer and run arbitrary code with the privileges of the vulnerable service. The flaw, caused by improper bounds checking (CWE-119), requires a local account (PR:L) but no victim interaction (UI:N). No public exploit code or active exploitation has been identified at time of analysis.
IBM Concert 1.0.0 through 2.1.0 stores sensitive information - such as credentials and secrets handled during recursive Docker builds - in cleartext on disk, allowing a local user with access to the build host to read and disclose it. The issue is purely a confidentiality exposure (C:H with I:N/A:N, CVSS 6.2) and requires local access to the host where recursive builds run, with PR:N and UI:N in the assessed vector; there is no public exploit identified at time of analysis, and EPSS is very low at 0.10% (1st percentile). Real-world risk is best characterized as low and depends heavily on how many local accounts can reach the build environment and its artifacts.
IBM UrbanCode Deploy (7.1 through 7.1.2.27, 7.2 through 7.2.3.20, 7.3 through 7.3.2.15) and IBM DevOps Deploy (8.0 through 8.0.1.10, 8.1 through 8.1.2.3) can briefly honor an existing http-session from a new client IP address because the client-IP binding enforcement is subject to a race condition, so a replayed or stolen session may be accepted for a short interval before the server invalidates it. Successful abuse requires an already-authenticated session identifier that the attacker possesses or can replay (CVSS PR:L), and the attacker must land inside a narrow timing window from a different IP address - conditions reflected in AC:H and the low 5.0 base score. There is no public exploit identified at time of analysis and EPSS is low at 0.19% (8th percentile), so this is a low-to-moderate priority hardening issue rather than an urgent, mass-exploitable flaw; exposure is limited to transient, probabilistic unauthorized access under specific network conditions.
In IBM DevOps Deploy 8.1 through 8.1.2.3, an authenticated user who holds LLM integration configuration privileges can recover a previously saved LLM API token - meaning a secret that is supposed to be write-only after storage can be read back out of the product. Exploitation is not reachable by unauthenticated or ordinary low-privileged users: it requires a valid session plus a specific administrative capability, and it only yields anything if an LLM integration has already been configured with a stored token, making it primarily an insider-abuse or post-compromise credential-recovery issue. There is no public exploit identified at time of analysis, EPSS is only 0.30% (21st percentile), and the flaw is confined to confidentiality of the stored token with no integrity or availability impact.
IBM DevOps Deploy versions 8.1 through 8.1.2.3 transmit data over an unencrypted channel, enabling a man-in-the-middle attacker to capture sensitive information. Exploitation requires the attacker to already occupy a privileged network position between components (high complexity, AC:H), and no authentication or user interaction is needed (PR:N/UI:N). With a low EPSS score of 0.19% and no public exploit identified at time of analysis, this is a moderate-severity confidentiality-only issue (CVSS 5.9) rather than an urgent threat.
Out-of-bounds read in Eclipse OMR 0.7.0 and later can occur when the compiler optimization for Latin-compatible charset to IBM-1047/037 EBCDIC translation mishandles NUL (0x00) bytes on IBM Z (s390x). The output byte array is truncated at the first NUL, discarding it and subsequent characters, so downstream code may read beyond the intended buffer; impact is bounded to limited information disclosure and possible instability, not code execution. This affects Eclipse OpenJ9 consumers of OMR on Z processors, non-Z platforms are not exposed, no public exploit has been identified at time of analysis, and the vendor-released fix is Eclipse OMR 0.8.0. The CVSS vector indicates PR:N (unauthenticated), and overall priority is moderate given the specific platform, data, and NUL-byte prerequisites.
Authenticated users of IBM Aspera Orchestrator 4.0.0 through 4.1.0 can inject operating-system commands that the application then executes with elevated privileges, giving a low-privileged account full control over the host (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the CVSS vector carries PR:L, exploitation requires a valid login on the Orchestrator instance; the attacker does not need victim interaction and can reach the vulnerable component over the network, making this primarily a post-compromise or credentialed-insider escalation path rather than a mass internet-exploitation candidate. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.48% (39th percentile), so immediate broad scanning activity is not indicated, but the impact once credentials are in hand is complete compromise of confidentiality, integrity, and availability.
SQL injection in IBM Aspera Orchestrator 4.0.0 through 4.1.0 lets an authenticated attacker with low privileges send crafted SQL statements to view, add, modify, or delete data in the back-end database. The CVSS v3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning remote exploitation is possible after authentication but not by fully anonymous internet users. No public exploit has been identified at time of analysis, and EPSS is 0.36% (28th percentile), making this a credible but not emergency-level priority.
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to degrade or exhaust the product's email service by repeatedly triggering email-generating operations faster than the service can process them, because the application does not properly control interaction frequency (CWE-799). The defect is availability-only - there is no data disclosure or modification - and exploitation requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5), so remote unauthenticated attackers cannot trigger it. EPSS places it at roughly 0.36% (27th percentile) and no public exploit code has been identified; this is a moderate-severity issue that should be prioritized behind higher-impact findings.
IBM Aspera Orchestrator 4.0.0 through 4.1.0 allows an authenticated remote user to change another user's password without knowing the original password, leading to potential account takeover and integrity compromise. The flaw (CWE-620, Unverified Password Change) requires a valid low-privilege account but no user interaction; it is network-reachable with no special configuration. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.28%, though risk increases in environments with many provisioned users, shared accounts, or exposed self-service portals.
IBM Planning Analytics Local versions 2.1.0 through 2.1.15 disclose sensitive server architecture information to authenticated users, potentially aiding further attacks against the system. The vulnerability requires low-privilege network access (CVSS 4.3, Medium) and has a low EPSS score (0.21%, 11th percentile), indicating limited exploitation likelihood. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; it is considered a low-to-moderate priority that is not urgent.
IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.
A remote code execution vulnerability (CVSS 2.7) that allows a privileged user. Remediation should follow standard vulnerability management procedures.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks.
Server-side request forgery (SSRF) in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 allows an authenticated attacker with low privileges to send unauthorized requests from the server, potentially leading to network enumeration or facilitating other attacks. This moderate-severity issue (CVSS 4.3) is low-priority in practice because it requires valid credentials and only impacts confidentiality. No public exploit code or active exploitation has been identified, and EPSS is 0.07% (22nd percentile).
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.
Local privilege escalation in IBM Informix Dynamic Server 14.10 allows a user who already holds a low-privilege account on the database host to log into the Informix server as administrator without supplying a password, giving full control over the database engine and its data. The issue is strictly local - the assessed CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) requires pre-existing access to the host and no user interaction, so it is not remotely exploitable and cannot be triggered against a system the attacker cannot already log into. Risk signals point to a genuine but locally-scoped flaw rather than a remote emergency: EPSS is 0.02% (5th percentile), the CVE is not in CISA KEV, and no public exploit code has been identified at time of analysis.
IBM Sterling B2B Integrator and Sterling File Gateway (6.0.0.0-6.1.2.7, 6.2.0.0-6.2.0.5, and 6.2.1.1) ship a sensitive session cookie without a restrictive SameSite attribute, allowing cross-site requests to carry that cookie. Following our assessment, exploitation requires a logged-in victim to be lured into interacting with an attacker-controlled cross-origin page, so the vector realistically includes user interaction (UI:R) despite the published PR:N/UI:N score, and impact is confidentiality-only. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and EPSS is very low at 0.05% (16th percentile), so this is a genuine-but-moderate configuration weakness rather than an urgent threat.
IBM Concert 1.0.0 through 2.0.0 relies on weaker-than-expected cryptographic algorithms, permitting an attacker who already possesses data encrypted by the product to recover highly sensitive plaintext. Exploitation cannot be initiated by a remote network request against a default deployment: the attacker must first obtain the protected ciphertext through on-path interception, access to encrypted data at rest, or a prior compromise, which makes the vulnerability a weakness-amplifier rather than a standalone entry point. The CVSS base score is 7.5 (High) with a network vector, but the independent assessment raises attack complexity to High and the EPSS score is 0.02% (6th percentile), with no public exploit code and no CISA KEV listing - indicating a low-priority, low-real-risk issue in practice. Impact is limited to confidentiality.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could reveal sensitive server IP configuration information to an unauthorized. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to execute a malicious command, due to inadequate filtering of. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable. No vendor patch available.
IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Concert 1.0.0 through 2.0.0 exposes sensitive server-side details through its HTTP response headers, letting remote attackers passively fingerprint the deployment - build/version banners, middleware or platform identifiers, and internal host or component names - and use that reconnaissance to plan follow-on attacks. The vendor scored this 7.5 (C:H), but the independently assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, because the leak by itself grants no access, alters no data, and exposes no credentials; meaningful harm requires chaining with a separate vulnerability. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified, and EPSS is only 0.05% (16th percentile), so real-world priority is low despite the High headline score.
IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to improper neutralization of output. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Concert 1.0.0 through 2.0.0 could allow a local user with specific permission to obtain sensitive information from files due to uncontrolled recursive directory copying. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. No vendor patch available.
IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 are impacted by obtaining an information vulnerability in the database plan cache implementation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Storage Virtualize 8.4, 8.5, 8.7, and 9.1 IKEv1 implementation allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated remote command execution affects IBM AIX 7.2/7.3 and IBM VIOS 3.1/4.1 hosts that run the nimsh (NIM Service Handler) client service with its SSL/TLS implementation exposed to the network, letting a remote attacker execute arbitrary commands against the target (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The root cause is improper process control (CWE-114), and IBM describes this as addressing additional attack vectors beyond those previously fixed for CVE-2024-56347, so environments that only applied the earlier fix stay exposed. No public exploit code has been identified at time of analysis and EPSS is low (0.14%, 34th percentile), but probability rises sharply wherever nimsh is reachable on its service ports (typically 3901/3902) rather than restricted to a trusted NIM master or management network.
Unauthenticated remote command execution affects IBM AIX 7.2 and 7.3 and IBM VIOS 3.1 and 4.1 systems configured with the NIM server (NIM master) role, where the 'nimesis' service is network-reachable. The flaw stems from improper process controls (CWE-114), and IBM notes it covers additional attack vectors for a defect previously fixed under CVE-2024-56346 - so hosts patched only for that CVE remain exposed to these new vectors. All severity signals align on CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating complete confidentiality, integrity and availability impact with no authentication or user interaction required; EPSS is currently low at 0.21% (43rd percentile) and no public exploit or CISA KEV listing has been identified at time of analysis.
Path traversal in the IBM AIX and VIOS NIM server service (nimesis) allows remote, unauthenticated attackers to write arbitrary files on hosts configured as NIM masters. AIX 7.2/7.3 and VIOS 3.1/4.1 systems are in scope only when they run and expose nimesis; ordinary NIM clients do not expose this service and are not exploitable through this path. No public exploit code was identified at time of analysis and EPSS is low (0.11%, 29th percentile), but successful exploitation can compromise confidentiality and integrity, and the independent assessment also rates availability impact high.
IBM AIX 7.2/7.3 and IBM VIOS 3.1/4.1 store the private keys used by Network Installation Management (NIM) in a way that leaves them exposed to interception, so an attacker who can position themselves as a man-in-the-middle on the network path between a NIM master and its clients can capture those keys and use them to impersonate trusted NIM endpoints (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H). Only systems actually running NIM - and whose NIM traffic crosses an attacker-controllable network segment - are realistically exposed; the high attack complexity reflects that MITM prerequisite, not any mitigation inside the product. Exploitation has not been observed in the wild (not in CISA KEV) and no public exploit code was identified at time of analysis, with EPSS at roughly 0.09% (25th percentile), so this reads as a serious-but-not-urgent credential-exposure flaw rather than a mass-exploitation priority.
IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.