IBM
Monthly
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operation. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while queue is freezed can deadlock[1], this is. No vendor patch available.
IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local privilege escalation to root in IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (including Db2 Connect Server) allows an attacker who already holds a low-privileged local account on the database host to execute malicious code that elevates them to root, because a Db2 component is configured to run with higher-than-minimum privileges (CWE-250, execution with unnecessary privileges). Exploitation requires both prior local access (AV:L, PR:L, UI:N) and a Db2 instance running in one of the specific configurations IBM calls out in advisory node 7250486, so default or unrelated configurations are not affected. This is a genuine but moderate-priority local privilege escalation rather than a broadly reachable flaw: CVSS 3.1 base score is 7.8 with high confidentiality, integrity and availability impact, EPSS is only about 0.03% (7th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. No vendor patch available.
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux (10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3) fails to properly invalidate expired credentials, so an authenticated user holding a stale, already-expired password can regain access to an account that has been locked out. The issue maps to CWE-324 (use of a key past its expiration date) and only manifests when a pre-existing Db2 account is simultaneously locked out and past its password expiration date, which narrows realistic exploitation to insiders or holders of stale credentials. No public exploit code has been identified at time of analysis and the EPSS score is negligible at 0.03% (10th percentile); the vendor's CVSS of 8.8 is inconsistent with the described behavior and the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so it should be treated with caution.
A crafted SQL query can crash IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 on Linux, UNIX, and Windows - including Db2 Connect Server - producing a full denial of service against the database instance. The root cause is CWE-789 (uncontrolled memory allocation): the server attempts an excessive allocation when processing the specially crafted query and terminates. IBM's published vector scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while our assessment places the realistic vector at PR:L, since delivering the malicious query in practice requires a valid, query-capable database session rather than an anonymous network packet; the practical barrier is therefore access to an authenticated connection plus network reachability to the Db2 listener. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low at 0.10% (28th percentile), so this reads as a moderate, availability-only risk rather than an emergency - but any crash of a production Db2 instance is business-impacting, so patching on a normal maintenance cadence remains appropriate.
A specially crafted SQL query can crash IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server, producing a denial of service in versions 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3. The issue is scored CVSS 7.5 with availability-only impact (C:N/I:N/A:H), and while the published vector claims PR:N, our independent assessment holds that submitting the malicious query in practice presupposes network reachability to the database listener and a valid authenticated Db2 session, so credentialed access is the likely prerequisite. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; EPSS is low at 0.14% (34th percentile), consistent with a targeted, availability-focused flaw in an enterprise database.
IBM OpenPages 9.1, and 9.0 with Watson is vulnerable to HTML injection. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XML external entity injection in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 lets remote attackers who can reach an XML-parsing endpoint read arbitrary files from the server's filesystem and exhaust memory until services degrade or crash. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/A:H, I:N) rates 9.1 and implies no authentication or user interaction is required, although real-world exposure hinges on whether the vulnerable XML ingestion path sits behind an authenticated console or an internal network boundary. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, and EPSS is 0.22% (44th percentile), so this is a genuinely serious flaw on paper but likely a measured rather than emergency priority.
Man-in-the-middle attackers can exploit improper access controls in IBM Cloud Pak for Business Automation 24.0.0, 24.0.1, and 25.0.0 to read unauthorized content or perform unauthorized actions. Exploitation requires the attacker to first achieve a man-in-the-middle position on the network path between a client and the service (CVSS AC:H), with no service-side authentication required and no user interaction; EPSS is 0.06%, no public exploit code was identified at time of analysis, and there is no CISA KEV entry.
IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation of input length. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Session cookie and token disclosure in IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 occurs because the application fails to set the Secure attribute, allowing network attackers to capture credentials when a victim follows an http:// link and the traffic is intercepted. Exploitation requires user interaction and an attacker with a man-in-the-middle or passive network position; this is a low-priority hardening gap (CVSS 5.3, EPSS 0.16%), with no public exploit or active exploitation identified at time of analysis.
Local privilege escalation in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 lets an authenticated non-root user who already has a session inside an affected container raise their privileges and capabilities within that container's scope. The root cause is a component executing with unnecessary privileges (CWE-250); the flaw is not network-reachable and requires a pre-existing low-privileged foothold in the deployed product to succeed. Impact is bounded to the container rather than the underlying host, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated path traversal in IBM Tivoli Monitoring 6.3.0.7 (including all service packs through SP21) lets remote attackers send crafted URLs with '/../' sequences to read, overwrite, or append to arbitrary files on the server. With a CVSS score of 9.8, this flaw can lead to complete compromise of the monitoring infrastructure if the web interface is reachable. No public exploit code or active exploitation has been identified at time of analysis, but the risk is high due to the unauthenticated nature and the potential for code execution via file overwrite.
Unauthenticated remote attackers can read arbitrary files from IBM Tivoli Monitoring 6.3.0.7 through Service Pack 21 by sending a crafted URL containing '/../' directory traversal sequences to the product's HTTP service. The flaw carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is bounded to information disclosure, with no write or code-execution capability indicated. No public exploit code or confirmed active exploitation was identified at time of analysis, but any network-exposed deployment matching the affected versions should be considered at risk.
Privilege escalation in IBM Sterling Connect:Direct for UNIX allows an already-privileged Control Center Director (CCD) user to gain further privileges because the product assigns unnecessary permissions to maintenance tasks and post-update scripts (CWE-250). Affected builds are 6.2.0.7 through 6.2.0.9 iFix004, 6.3.0.2 through 6.3.0.5 iFix002, and 6.4.0.0 through 6.4.0.2 iFix001 on UNIX; exploitation requires an authenticated CCD account with a high-privilege role (CVSS PR:H) and access to the maintenance/post-update-script workflow, so no unauthenticated or low-privilege outsider path exists. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); NVD scores it 7.2 (AV:N) while our independent assessment rates the practical vector as local (AV:L) given the required privileged local/admin foothold.
Use-after-free memory corruption in X.Org X server's Xkb extension allows local authenticated attackers to achieve high confidentiality impact, low integrity impact, and high availability impact (CVSS 7.3) through improper resource cleanup during client disconnection. The vulnerability affects Red Hat Enterprise Linux distributions with multiple security advisories released (RHSA-2025:19432 through RHSA-2025:22055). EPSS data not provided, but the local attack vector (AV:L) and low complexity (AC:L) indicate exploitation requires authenticated local access. No CISA KEV listing or public POC identified at time of analysis.
Local privilege escalation in X.Org X server's Xkb extension affects RHEL-family distributions, allowing authenticated users to corrupt memory or crash the X server via integer overflow in XkbSetCompatMap(). Attack requires local access with low-privilege credentials. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. Red Hat has released patches across multiple RHEL versions (RHSA-2025:19432 through RHSA-2025:22055).
Authentication bypass in IBM Maximo Application Suite (versions 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4) allows an unauthenticated remote attacker to reach the application without valid credentials, yielding high impact across confidentiality, integrity and availability - consistent with the CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, but because no credentials and no user interaction are required, any instance reachable over the network - especially internet-facing or broadly reachable internal deployments - is exposed to full compromise. The IBM advisory (support node 7249416) is the authoritative source for affected builds and fixes, and the specific vulnerable feature or authentication flow is not detailed in the available data.
Server-side request forgery in IBM Concert 1.0.0 through 2.0.0 allows an authenticated user who can reach a URL-fetching feature to make the server issue requests to attacker-chosen destinations, enabling internal network enumeration and access to services or cloud metadata endpoints reachable from the Concert host's network position. The flaw (CWE-918, CVSS 5.4, vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) requires a valid low-privileged account and no user interaction, and its impact is bounded by what the server itself can reach. No public exploit code has been identified at time of analysis and EPSS is only 0.16% (5th percentile), so this is not a confirmed-actively-exploited issue and represents low real-world priority.
Information disclosure in IBM Concert Software 1.0.0 through 2.0.0 allows an authenticated local user to read sensitive data that the application leaves behind in heap buffers it frees without first clearing (CWE-244). Exploitation is confined to the local host and requires low privileges (CVSS 3.1 AV:L/AC:L/PR:L, medium 5.5, confidentiality-only impact), and because the attacker cannot control which residual data happens to remain in freed memory, any leak is opportunistic rather than deterministic. No public exploit code is identified, the issue is not in CISA KEV, and EPSS is negligible at 0.12% (1st percentile), so this rates as a genuinely low-priority finding despite the medium base score.
Improper neutralization of log input in IBM Concert versions 1.0.0 through 2.0.0 allows a remote attacker to forge, spoof, or corrupt system log entries by injecting newline/CRLF or control characters into application input fields that are written verbatim into system logs. The flaw is network-reachable with low attack complexity and requires no user interaction per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to log integrity - no data confidentiality or availability loss. Overall risk is low: EPSS is only 0.22% (11th percentile), no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so this is an audit-integrity nuisance rather than a code-execution or data-theft primitive.
IBM Db2 High Performance Unload (HPU) versions 5.1 through 6.5.0.0 IF1 contain an out-of-bounds write (CWE-787) that an authenticated user can trigger with crafted input, causing the utility to crash and resulting in a denial-of-service condition. The vulnerability requires valid credentials (PR:L) and is network-reachable (AV:N) with low complexity (AC:L) and no user interaction, but the assessed impact is limited to availability (A:H) with no confirmed confidentiality or integrity impact and no evidence of code execution. EPSS is low at 0.31% (21st percentile), and no public exploit code or active exploitation (CISA KEV) has been identified.
IBM DB2 High Performance Unload (HPU) contains a denial-of-service vulnerability that allows an authenticated remote user to crash the utility by triggering an incorrect pointer-size calculation. The flaw, tracked as CWE-467, has a CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it requires valid credentials, can be exploited over the network, and impacts only availability with no confidentiality or integrity loss. EPSS is 0.31% (21st percentile) and no public exploit code has been identified, so this is a moderate, availability-only issue that is not a priority for emergency patching.
Authenticated users of IBM DB2 High Performance Unload (HPU) versions 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.0 IF1 can trigger a stack buffer overwrite that crashes the utility process, producing a denial-of-service condition with no confidentiality or integrity impact. The flaw requires a valid authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 6.5), is rated low risk by EPSS (0.31%, 21st percentile), and is not listed in CISA KEV; no public exploit code was identified at time of analysis, and the exact input or utility operation that overflows the stack allocation is not disclosed in the vendor advisory.
Denial of service in IBM Db2 High Performance Unload (HPU) 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.0 IF1 allows an authenticated user to crash the program by supplying input that reaches a routine which miscalculates a buffer size (CWE-131). The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5), meaning remote exploitation is possible but requires valid credentials (PR:L), and the only confirmed impact is availability: no confidentiality or integrity loss, and no code execution is demonstrated. No public exploit code or confirmed active exploitation has been reported, and EPSS is low at 0.31% (21st percentile), so real-world risk is driven mainly by exposure of this specialized Db2 add-on to untrusted authenticated users rather than by broad opportunistic scanning.
Stored cross-site scripting in IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Interim Fix 02 allows an authenticated, low-privileged user to inject JavaScript into the Web UI that executes when a separate user views the affected page, potentially leading to credential disclosure within a trusted session. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, and the EPSS score is low at 0.18% (7th percentile). This is a genuine but moderate-priority issue because exploitation requires valid credentials and victim interaction.
Stored cross-site scripting in IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Interim Fix 02 lets an authenticated console user embed arbitrary JavaScript in a persisted Web UI field, which then executes in the browser of any second trusted user - typically a SOC analyst or administrator - who later opens the affected page, potentially exposing credentials or session data inside a trusted session. Exploitation requires both a valid QRadar account (CVSS PR:L) and victim interaction (UI:R), so an anonymous or external attacker cannot trigger it directly and the payload lies dormant until a victim views it. Risk is moderate rather than urgent for a 5.4-scored issue: no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and exposure is confined to environments not yet running a fixed build.
Local privilege escalation in IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Interim Fix 02 lets an attacker who already holds low-privileged authenticated access on the appliance elevate to higher (typically root-level) privileges by abusing improper privilege assignment on an update script. The flaw requires local shell access (CVSS 3.1 AV:L, PR:L), so it is a post-compromise or malicious-insider escalation primitive rather than an initial-access or network-facing issue, and exploitation does not require user interaction. Risk signals are modest: EPSS is 0.12% (2nd percentile), no public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, though a successful exploit would yield high confidentiality, integrity, and availability impact on the SIEM host.
Stored HTML injection in IBM OpenPages 9.0 and 9.1 allows an authenticated remote attacker to place malicious HTML into content that, when viewed by another user, is rendered in the victim's browser within the hosting site's security context. Exploitation requires a valid OpenPages session (PR:L) and victim interaction (UI:R), with low confidentiality and integrity impact and no availability impact; no public exploit code has been identified, and EPSS is low at 0.18% (7th percentile). This is a genuinely moderate, not high, priority issue.
Use-after-free and kernel WARNING in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger memory corruption via the splice() path on an SMC socket. The smc_lo_register_dmb() loopback path allocates DMB buffers with kzalloc() (kmalloc memory, not page-backed), which are later handed to get_page() in smc_rx_splice(); this fires WARN_ON_ONCE() and can leave the buffer freed before splice_to_pipe() completes, creating a use-after-free. CVSS 7.8 (local, C:H/I:H/A:H); EPSS is low (0.22%, 13th percentile) and there is no public exploit identified at time of analysis.
Denial of service in IBM MQ 9.1, 9.2, 9.3 and 9.4 LTS and 9.3/9.4 Continuous Delivery lets remote unauthenticated attackers hold queue manager connections open with slow or incomplete read operations, draining connection and thread resources until legitimate messaging clients can no longer connect. The root cause is improper enforcement of the timeout on individual read operations (CWE-772, resource not released after its effective lifetime), and exploitation requires only network reachability to an IBM MQ TCP listener such as the default channel port 1414 - no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). Impact is confined to availability: EPSS is 0.54% (~44th percentile), no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), making this a moderate-priority availability issue whose real-world risk is bounded by whether the listener is exposed to untrusted networks.
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5 and 6.2.1.0, along with IBM Sterling File Gateway in the same version ranges, expose stored user credentials in configuration files to a local low-privileged authenticated user who can read those files. The issue is local-only (CVSS AV:L/PR:L/UI:N), with high confidentiality impact but no direct integrity or availability effect. EPSS is 0.15% (4th percentile), and no public exploit was identified at time of analysis.
Directory listing exposure in IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 lets unauthenticated remote users browse and enumerate the application's file and folder names by requesting certain application URLs, because the deployment serves a directory index rather than blocking the request. Only names are disclosed - file contents cannot be read, obtained, or modified - so the practical impact is reconnaissance that may aid follow-on targeting rather than direct data theft, and the assessed CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.31% (21st percentile), making this a low-to-moderate priority issue to remediate on a routine hardening cycle, prioritizing any instance that is internet-facing.
Hard-coded credentials in IBM Security Verify Access 10.0.0 through 10.0.9 and 11.0.0, and in Verify Identity Access Container, can expose inbound authentication, outbound communication to external components, or encryption of internal data when a deployment uses the affected static password or key. The vendor CVSS is 9.8, but our assessment treats exploitability as high-complexity because the target must be configured to use the embedded secret and the attacker must know or recover it. No public exploit is identified at time of analysis, and EPSS is low at 0.29% (20th percentile).
An authenticated user can cause a denial-of-service condition in IBM DOORS Next versions 7.0.2, 7.0.3, and 7.1 by uploading a specially crafted file that triggers uncontrolled recursion (CWE-674) during server-side parsing, leading to high availability impact while confidentiality and integrity remain unaffected. Exploitation requires valid credentials and access to the file-upload functionality, so the attack surface is limited to authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and EPSS is low at 0.31% (21st percentile), suggesting limited near-term exploitation likelihood.
Email sender-identity spoofing in IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 allows an authenticated user on the adjacent network to forge the sender identity of email generated by the application, because the product performs improper verification of source data (CWE-346). Exploitation requires valid credentials (PR:L) and an adjacent-network position (AV:A) rather than internet exposure, needs no user interaction (UI:N), and is low complexity (AC:L); impact is confined to integrity (I:H) with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and the EPSS score of 0.12% (2nd percentile) indicates a low likelihood of real-world exploitation; this is a moderate-severity integrity issue rather than a top patching priority.
Authenticated users of IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 can delete review artifacts belonging to other users because review-deletion authorization is enforced only in the client-side UI while the underlying server endpoint performs no equivalent check (CWE-602, client-side enforcement of server-side security). The issue requires a valid authenticated account (CVSS PR:L), needs no user interaction or non-default configuration, and is limited to integrity impact - no confidentiality loss and no denial of service - with IBM rating it adjacent-network (AV:A) while the independent assessment rates it network-reachable (AV:N); both agree impact is low. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, and the EPSS score is 0.18% (7th percentile), consistent with a genuinely low-priority, authenticated-only integrity flaw rather than an actively exploited one.
Authenticated users of IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 can delete comments made by other users because comment-deletion authorization is enforced only in the client interface rather than rechecked on the server. This CWE-602 flaw requires a valid account and adjacent-network access per the CVSS vector (AV:A/PR:L), yields only a low integrity impact (CVSS 3.5), and has no public exploit identified at time of analysis, with an EPSS score of 0.18%. The practical risk is low, consistent with the vendor's rating.
IBM Aspera Faspex versions 5.0.0 through 5.0.13.1 allow an authenticated low-privilege user to infer sensitive system information by observing discrepancies in returned data (CWE-203). The vulnerability requires valid credentials and only affects confidentiality with limited impact, as no data modification or service disruption is possible. No public exploit code has been identified, and the EPSS score is 0.23%, indicating a low likelihood of exploitation.
Denial of service in IBM Aspera Faspex 5.0.0 through 5.0.13.1 allows a high-privileged, authenticated API user to consume excessive resources through improperly validated input, causing availability loss. Because exploitation requires PR:H credentials, realistic risk is confined to malicious insiders or post-compromise scenarios; EPSS is 0.32% (23rd percentile) and no public exploit has been identified at time of analysis.
Local code execution affects IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4, where improper bounds checking on the files that store the CECSUB or CECRM objects allows a stack-based buffer overflow and arbitrary code execution on the system. The issue carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning an authenticated local user who can already read and write the container files holding CECSUB or CECRM can trigger it with no user interaction and gain full confidentiality, integrity, and availability impact on the host. It is not confirmed actively exploited (no CISA KEV listing), no public exploit code has been identified at time of analysis, and the LOCAL vector plus the specialized z/OS mainframe deployment context make this a high-severity but comparatively low-urgency item under real-world triage.
Stored cross-site scripting in IBM Jazz Foundation - the shared platform underlying IBM Engineering Requirements Management DOORS Next - lets an authenticated, low-privileged user embed arbitrary JavaScript in Web UI fields that is later rendered in another user's browser, potentially disclosing credentials within a trusted session (CVSS 5.4, CWE-79). Affected builds are 7.0.2 through 7.0.2 iFix034, 7.0.3 through 7.0.3 iFix016, and 7.1.0 through 7.1.0 iFix004. Exploitation requires a valid account (PR:L) and a second user who views the injected content (UI:R); no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and there is no KEV listing, making this a second-tier priority rather than an active emergency.
Local privilege escalation in IBM Security Verify Access and Verify Identity Access 10.0.x/11.0.x allows an authenticated local user to obtain root because a component executes with more privileges than required (CWE-250). The flaw affects bare-metal and Docker deployments across 10.0.0.0-10.0.9.0 and 11.0.0.0-11.0.1.0, is local-only (AV:L) and requires existing local credentials under the authoritative assessment, so it cannot be triggered remotely over the network. No public exploit was identified at time of analysis, and IBM has released a vendor patch/advisory.
Security Verify Access and its Docker deployment can be induced to execute malicious scripts sourced from outside the product's control sphere, affecting both interactive and containerized installations in the 10.0.0.0-10.0.9.0 and 11.0.0.0-11.0.1.0 ranges, including Verify Identity Access 11.0.1.0. IBM rates the issue 8.5, but the supplied CVSS vector's PR:N conflicts with the description's requirement for a locally authenticated user, so the authentication prerequisite should be confirmed. No public exploit identified at time of analysis.
Unauthenticated OS command injection in IBM Security Verify Access (including the Docker distribution and Verify Identity Access) versions 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 lets a remote attacker who can reach the affected management/runtime interface execute arbitrary operating-system commands with the privileges of a lower-privileged service account, scored CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Because the injected commands run as a non-root user, confidentiality, integrity and availability impact is limited per-request, but the foothold can be used as a pivot for further privilege escalation against the appliance or container. Impact is bounded to the listed version ranges; IBM has published a vendor fix, and no public exploit code or confirmed active exploitation was identified at time of analysis.
IBM Transformation Extender Advanced 10.0.1 could allow a local user to perform unauthorized actions due to improper access controls.
CVE-2023-49883 is a security vulnerability (CVSS 5.9). Remediation should follow standard vulnerability management procedures.
IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
IBM Transformation Extender Advanced 10.0.1 stores potentially sensitive information in log files that could be read by a local user.
IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized actions. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Lakehouse (watsonx.data 2.2) stores potentially sensitive information in log files that could be read by a local user. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 through 11.1.1 sign session cookies with a hardcoded cryptographic key, so an attacker who recovers that static key can forge trusted cookies and obtain sensitive information. The CVSS vector indicates network exploitation without authentication, but practical exploitation depends on first obtaining the embedded key; EPSS is 0.03% and no public exploit has been identified at time of analysis. IBM has published an advisory at https://www.ibm.com/support/pages/node/7246015.
IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Copy Services Manager 6.3.13 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks against the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Lakehouse (watsonx.data 2.2) is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: powerpc: Don't try to copy PPR for task with NULL pt_regs powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with root privileges due to improper. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM PowerVM Hypervisor FW950.00 through FW950.E0, FW1050.00 through FW1050.50, and FW1060.00 through FW1060.40 could allow a local privileged user to cause a denial of service by issuing a specially. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files due to improper permission assignment. Rated low severity (CVSS 2.3), this vulnerability is low attack complexity. No vendor patch available.
IBM Fusion (2.2.0 through 2.10.1), IBM Fusion HCI (2.2.0 through 2.10.0), and IBM Fusion HCI for watsonx (2.8.2 through 2.10.0) ship an insecure default configuration that can leave the bundled AMQStreams (Apache Kafka) broker exposed without client authentication, allowing any party with network reachability to publish, consume, or administer topics and cluster metadata without credentials - a full confidentiality, integrity, and availability impact reflected in the 9.8 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-1188). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is only 0.03% (10th percentile), so near-term exploitation likelihood is assessed as low. The practical limiting factor is exposure: AMQStreams is normally an in-cluster OpenShift component, so deployments that already require Kafka client authentication or restrict the listener to internal cluster traffic are not realistically exploitable.
In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a privileged user to escalate their privileges and attack surface on the host due to the containers running with. Rated medium severity (CVSS 6.4). No vendor patch available.
IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a remote user to cause a denial of service due to improper handling of special characters that could lead to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Hardware Management Console - Power 10.3.1050.0 and 11.1.1110.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operation. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix potential deadlock while nr_requests grown Allocate and free sched_tags while queue is freezed can deadlock[1], this is. No vendor patch available.
IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local privilege escalation to root in IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (including Db2 Connect Server) allows an attacker who already holds a low-privileged local account on the database host to execute malicious code that elevates them to root, because a Db2 component is configured to run with higher-than-minimum privileges (CWE-250, execution with unnecessary privileges). Exploitation requires both prior local access (AV:L, PR:L, UI:N) and a Db2 instance running in one of the specific configurations IBM calls out in advisory node 7250486, so default or unrelated configurations are not affected. This is a genuine but moderate-priority local privilege escalation rather than a broadly reachable flaw: CVSS 3.1 base score is 7.8 with high confidentiality, integrity and availability impact, EPSS is only about 0.03% (7th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required. No vendor patch available.
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Db2 for Linux (10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3) fails to properly invalidate expired credentials, so an authenticated user holding a stale, already-expired password can regain access to an account that has been locked out. The issue maps to CWE-324 (use of a key past its expiration date) and only manifests when a pre-existing Db2 account is simultaneously locked out and past its password expiration date, which narrows realistic exploitation to insiders or holders of stale credentials. No public exploit code has been identified at time of analysis and the EPSS score is negligible at 0.03% (10th percentile); the vendor's CVSS of 8.8 is inconsistent with the described behavior and the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so it should be treated with caution.
A crafted SQL query can crash IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 on Linux, UNIX, and Windows - including Db2 Connect Server - producing a full denial of service against the database instance. The root cause is CWE-789 (uncontrolled memory allocation): the server attempts an excessive allocation when processing the specially crafted query and terminates. IBM's published vector scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while our assessment places the realistic vector at PR:L, since delivering the malicious query in practice requires a valid, query-capable database session rather than an anonymous network packet; the practical barrier is therefore access to an authenticated connection plus network reachability to the Db2 listener. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low at 0.10% (28th percentile), so this reads as a moderate, availability-only risk rather than an emergency - but any crash of a production Db2 instance is business-impacting, so patching on a normal maintenance cadence remains appropriate.
A specially crafted SQL query can crash IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server, producing a denial of service in versions 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3. The issue is scored CVSS 7.5 with availability-only impact (C:N/I:N/A:H), and while the published vector claims PR:N, our independent assessment holds that submitting the malicious query in practice presupposes network reachability to the database listener and a valid authenticated Db2 session, so credentialed access is the likely prerequisite. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation; EPSS is low at 0.14% (34th percentile), consistent with a targeted, availability-focused flaw in an enterprise database.
IBM OpenPages 9.1, and 9.0 with Watson is vulnerable to HTML injection. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
XML external entity injection in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 lets remote attackers who can reach an XML-parsing endpoint read arbitrary files from the server's filesystem and exhaust memory until services degrade or crash. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/A:H, I:N) rates 9.1 and implies no authentication or user interaction is required, although real-world exposure hinges on whether the vulnerable XML ingestion path sits behind an authenticated console or an internal network boundary. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, and EPSS is 0.22% (44th percentile), so this is a genuinely serious flaw on paper but likely a measured rather than emergency priority.
Man-in-the-middle attackers can exploit improper access controls in IBM Cloud Pak for Business Automation 24.0.0, 24.0.1, and 25.0.0 to read unauthorized content or perform unauthorized actions. Exploitation requires the attacker to first achieve a man-in-the-middle position on the network path between a client and the service (CVSS AC:H), with no service-side authentication required and no user interaction; EPSS is 0.06%, no public exploit code was identified at time of analysis, and there is no CISA KEV entry.
IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation of input length. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Session cookie and token disclosure in IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 occurs because the application fails to set the Secure attribute, allowing network attackers to capture credentials when a victim follows an http:// link and the traffic is intercepted. Exploitation requires user interaction and an attacker with a man-in-the-middle or passive network position; this is a low-priority hardening gap (CVSS 5.3, EPSS 0.16%), with no public exploit or active exploitation identified at time of analysis.
Local privilege escalation in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 lets an authenticated non-root user who already has a session inside an affected container raise their privileges and capabilities within that container's scope. The root cause is a component executing with unnecessary privileges (CWE-250); the flaw is not network-reachable and requires a pre-existing low-privileged foothold in the deployed product to succeed. Impact is bounded to the container rather than the underlying host, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated path traversal in IBM Tivoli Monitoring 6.3.0.7 (including all service packs through SP21) lets remote attackers send crafted URLs with '/../' sequences to read, overwrite, or append to arbitrary files on the server. With a CVSS score of 9.8, this flaw can lead to complete compromise of the monitoring infrastructure if the web interface is reachable. No public exploit code or active exploitation has been identified at time of analysis, but the risk is high due to the unauthenticated nature and the potential for code execution via file overwrite.
Unauthenticated remote attackers can read arbitrary files from IBM Tivoli Monitoring 6.3.0.7 through Service Pack 21 by sending a crafted URL containing '/../' directory traversal sequences to the product's HTTP service. The flaw carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is bounded to information disclosure, with no write or code-execution capability indicated. No public exploit code or confirmed active exploitation was identified at time of analysis, but any network-exposed deployment matching the affected versions should be considered at risk.
Privilege escalation in IBM Sterling Connect:Direct for UNIX allows an already-privileged Control Center Director (CCD) user to gain further privileges because the product assigns unnecessary permissions to maintenance tasks and post-update scripts (CWE-250). Affected builds are 6.2.0.7 through 6.2.0.9 iFix004, 6.3.0.2 through 6.3.0.5 iFix002, and 6.4.0.0 through 6.4.0.2 iFix001 on UNIX; exploitation requires an authenticated CCD account with a high-privilege role (CVSS PR:H) and access to the maintenance/post-update-script workflow, so no unauthenticated or low-privilege outsider path exists. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); NVD scores it 7.2 (AV:N) while our independent assessment rates the practical vector as local (AV:L) given the required privileged local/admin foothold.
Use-after-free memory corruption in X.Org X server's Xkb extension allows local authenticated attackers to achieve high confidentiality impact, low integrity impact, and high availability impact (CVSS 7.3) through improper resource cleanup during client disconnection. The vulnerability affects Red Hat Enterprise Linux distributions with multiple security advisories released (RHSA-2025:19432 through RHSA-2025:22055). EPSS data not provided, but the local attack vector (AV:L) and low complexity (AC:L) indicate exploitation requires authenticated local access. No CISA KEV listing or public POC identified at time of analysis.
Local privilege escalation in X.Org X server's Xkb extension affects RHEL-family distributions, allowing authenticated users to corrupt memory or crash the X server via integer overflow in XkbSetCompatMap(). Attack requires local access with low-privilege credentials. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. Red Hat has released patches across multiple RHEL versions (RHSA-2025:19432 through RHSA-2025:22055).
Authentication bypass in IBM Maximo Application Suite (versions 9.0.0 through 9.0.15 and 9.1.0 through 9.1.4) allows an unauthenticated remote attacker to reach the application without valid credentials, yielding high impact across confidentiality, integrity and availability - consistent with the CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, but because no credentials and no user interaction are required, any instance reachable over the network - especially internet-facing or broadly reachable internal deployments - is exposed to full compromise. The IBM advisory (support node 7249416) is the authoritative source for affected builds and fixes, and the specific vulnerable feature or authentication flow is not detailed in the available data.
Server-side request forgery in IBM Concert 1.0.0 through 2.0.0 allows an authenticated user who can reach a URL-fetching feature to make the server issue requests to attacker-chosen destinations, enabling internal network enumeration and access to services or cloud metadata endpoints reachable from the Concert host's network position. The flaw (CWE-918, CVSS 5.4, vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) requires a valid low-privileged account and no user interaction, and its impact is bounded by what the server itself can reach. No public exploit code has been identified at time of analysis and EPSS is only 0.16% (5th percentile), so this is not a confirmed-actively-exploited issue and represents low real-world priority.
Information disclosure in IBM Concert Software 1.0.0 through 2.0.0 allows an authenticated local user to read sensitive data that the application leaves behind in heap buffers it frees without first clearing (CWE-244). Exploitation is confined to the local host and requires low privileges (CVSS 3.1 AV:L/AC:L/PR:L, medium 5.5, confidentiality-only impact), and because the attacker cannot control which residual data happens to remain in freed memory, any leak is opportunistic rather than deterministic. No public exploit code is identified, the issue is not in CISA KEV, and EPSS is negligible at 0.12% (1st percentile), so this rates as a genuinely low-priority finding despite the medium base score.
Improper neutralization of log input in IBM Concert versions 1.0.0 through 2.0.0 allows a remote attacker to forge, spoof, or corrupt system log entries by injecting newline/CRLF or control characters into application input fields that are written verbatim into system logs. The flaw is network-reachable with low attack complexity and requires no user interaction per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to log integrity - no data confidentiality or availability loss. Overall risk is low: EPSS is only 0.22% (11th percentile), no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so this is an audit-integrity nuisance rather than a code-execution or data-theft primitive.
IBM Db2 High Performance Unload (HPU) versions 5.1 through 6.5.0.0 IF1 contain an out-of-bounds write (CWE-787) that an authenticated user can trigger with crafted input, causing the utility to crash and resulting in a denial-of-service condition. The vulnerability requires valid credentials (PR:L) and is network-reachable (AV:N) with low complexity (AC:L) and no user interaction, but the assessed impact is limited to availability (A:H) with no confirmed confidentiality or integrity impact and no evidence of code execution. EPSS is low at 0.31% (21st percentile), and no public exploit code or active exploitation (CISA KEV) has been identified.
IBM DB2 High Performance Unload (HPU) contains a denial-of-service vulnerability that allows an authenticated remote user to crash the utility by triggering an incorrect pointer-size calculation. The flaw, tracked as CWE-467, has a CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it requires valid credentials, can be exploited over the network, and impacts only availability with no confidentiality or integrity loss. EPSS is 0.31% (21st percentile) and no public exploit code has been identified, so this is a moderate, availability-only issue that is not a priority for emergency patching.
Authenticated users of IBM DB2 High Performance Unload (HPU) versions 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.0 IF1 can trigger a stack buffer overwrite that crashes the utility process, producing a denial-of-service condition with no confidentiality or integrity impact. The flaw requires a valid authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 6.5), is rated low risk by EPSS (0.31%, 21st percentile), and is not listed in CISA KEV; no public exploit code was identified at time of analysis, and the exact input or utility operation that overflows the stack allocation is not disclosed in the vendor advisory.
Denial of service in IBM Db2 High Performance Unload (HPU) 5.1, 5.1.0.1, 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.5, and 6.5.0.0 IF1 allows an authenticated user to crash the program by supplying input that reaches a routine which miscalculates a buffer size (CWE-131). The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5), meaning remote exploitation is possible but requires valid credentials (PR:L), and the only confirmed impact is availability: no confidentiality or integrity loss, and no code execution is demonstrated. No public exploit code or confirmed active exploitation has been reported, and EPSS is low at 0.31% (21st percentile), so real-world risk is driven mainly by exposure of this specialized Db2 add-on to untrusted authenticated users rather than by broad opportunistic scanning.
Stored cross-site scripting in IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Interim Fix 02 allows an authenticated, low-privileged user to inject JavaScript into the Web UI that executes when a separate user views the affected page, potentially leading to credential disclosure within a trusted session. No public exploit code or active exploitation (CISA KEV) is identified at time of analysis, and the EPSS score is low at 0.18% (7th percentile). This is a genuine but moderate-priority issue because exploitation requires valid credentials and victim interaction.
Stored cross-site scripting in IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Interim Fix 02 lets an authenticated console user embed arbitrary JavaScript in a persisted Web UI field, which then executes in the browser of any second trusted user - typically a SOC analyst or administrator - who later opens the affected page, potentially exposing credentials or session data inside a trusted session. Exploitation requires both a valid QRadar account (CVSS PR:L) and victim interaction (UI:R), so an anonymous or external attacker cannot trigger it directly and the payload lies dormant until a victim views it. Risk is moderate rather than urgent for a 5.4-scored issue: no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and exposure is confined to environments not yet running a fixed build.
Local privilege escalation in IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Interim Fix 02 lets an attacker who already holds low-privileged authenticated access on the appliance elevate to higher (typically root-level) privileges by abusing improper privilege assignment on an update script. The flaw requires local shell access (CVSS 3.1 AV:L, PR:L), so it is a post-compromise or malicious-insider escalation primitive rather than an initial-access or network-facing issue, and exploitation does not require user interaction. Risk signals are modest: EPSS is 0.12% (2nd percentile), no public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, though a successful exploit would yield high confidentiality, integrity, and availability impact on the SIEM host.
Stored HTML injection in IBM OpenPages 9.0 and 9.1 allows an authenticated remote attacker to place malicious HTML into content that, when viewed by another user, is rendered in the victim's browser within the hosting site's security context. Exploitation requires a valid OpenPages session (PR:L) and victim interaction (UI:R), with low confidentiality and integrity impact and no availability impact; no public exploit code has been identified, and EPSS is low at 0.18% (7th percentile). This is a genuinely moderate, not high, priority issue.
Use-after-free and kernel WARNING in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger memory corruption via the splice() path on an SMC socket. The smc_lo_register_dmb() loopback path allocates DMB buffers with kzalloc() (kmalloc memory, not page-backed), which are later handed to get_page() in smc_rx_splice(); this fires WARN_ON_ONCE() and can leave the buffer freed before splice_to_pipe() completes, creating a use-after-free. CVSS 7.8 (local, C:H/I:H/A:H); EPSS is low (0.22%, 13th percentile) and there is no public exploit identified at time of analysis.
Denial of service in IBM MQ 9.1, 9.2, 9.3 and 9.4 LTS and 9.3/9.4 Continuous Delivery lets remote unauthenticated attackers hold queue manager connections open with slow or incomplete read operations, draining connection and thread resources until legitimate messaging clients can no longer connect. The root cause is improper enforcement of the timeout on individual read operations (CWE-772, resource not released after its effective lifetime), and exploitation requires only network reachability to an IBM MQ TCP listener such as the default channel port 1414 - no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). Impact is confined to availability: EPSS is 0.54% (~44th percentile), no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), making this a moderate-priority availability issue whose real-world risk is bounded by whether the listener is exposed to untrusted networks.
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5 and 6.2.1.0, along with IBM Sterling File Gateway in the same version ranges, expose stored user credentials in configuration files to a local low-privileged authenticated user who can read those files. The issue is local-only (CVSS AV:L/PR:L/UI:N), with high confidentiality impact but no direct integrity or availability effect. EPSS is 0.15% (4th percentile), and no public exploit was identified at time of analysis.
Directory listing exposure in IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 lets unauthenticated remote users browse and enumerate the application's file and folder names by requesting certain application URLs, because the deployment serves a directory index rather than blocking the request. Only names are disclosed - file contents cannot be read, obtained, or modified - so the practical impact is reconnaissance that may aid follow-on targeting rather than direct data theft, and the assessed CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.31% (21st percentile), making this a low-to-moderate priority issue to remediate on a routine hardening cycle, prioritizing any instance that is internet-facing.
Hard-coded credentials in IBM Security Verify Access 10.0.0 through 10.0.9 and 11.0.0, and in Verify Identity Access Container, can expose inbound authentication, outbound communication to external components, or encryption of internal data when a deployment uses the affected static password or key. The vendor CVSS is 9.8, but our assessment treats exploitability as high-complexity because the target must be configured to use the embedded secret and the attacker must know or recover it. No public exploit is identified at time of analysis, and EPSS is low at 0.29% (20th percentile).
An authenticated user can cause a denial-of-service condition in IBM DOORS Next versions 7.0.2, 7.0.3, and 7.1 by uploading a specially crafted file that triggers uncontrolled recursion (CWE-674) during server-side parsing, leading to high availability impact while confidentiality and integrity remain unaffected. Exploitation requires valid credentials and access to the file-upload functionality, so the attack surface is limited to authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and EPSS is low at 0.31% (21st percentile), suggesting limited near-term exploitation likelihood.
Email sender-identity spoofing in IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 allows an authenticated user on the adjacent network to forge the sender identity of email generated by the application, because the product performs improper verification of source data (CWE-346). Exploitation requires valid credentials (PR:L) and an adjacent-network position (AV:A) rather than internet exposure, needs no user interaction (UI:N), and is low complexity (AC:L); impact is confined to integrity (I:H) with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and the EPSS score of 0.12% (2nd percentile) indicates a low likelihood of real-world exploitation; this is a moderate-severity integrity issue rather than a top patching priority.
Authenticated users of IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 can delete review artifacts belonging to other users because review-deletion authorization is enforced only in the client-side UI while the underlying server endpoint performs no equivalent check (CWE-602, client-side enforcement of server-side security). The issue requires a valid authenticated account (CVSS PR:L), needs no user interaction or non-default configuration, and is limited to integrity impact - no confidentiality loss and no denial of service - with IBM rating it adjacent-network (AV:A) while the independent assessment rates it network-reachable (AV:N); both agree impact is low. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, and the EPSS score is 0.18% (7th percentile), consistent with a genuinely low-priority, authenticated-only integrity flaw rather than an actively exploited one.
Authenticated users of IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 can delete comments made by other users because comment-deletion authorization is enforced only in the client interface rather than rechecked on the server. This CWE-602 flaw requires a valid account and adjacent-network access per the CVSS vector (AV:A/PR:L), yields only a low integrity impact (CVSS 3.5), and has no public exploit identified at time of analysis, with an EPSS score of 0.18%. The practical risk is low, consistent with the vendor's rating.
IBM Aspera Faspex versions 5.0.0 through 5.0.13.1 allow an authenticated low-privilege user to infer sensitive system information by observing discrepancies in returned data (CWE-203). The vulnerability requires valid credentials and only affects confidentiality with limited impact, as no data modification or service disruption is possible. No public exploit code has been identified, and the EPSS score is 0.23%, indicating a low likelihood of exploitation.
Denial of service in IBM Aspera Faspex 5.0.0 through 5.0.13.1 allows a high-privileged, authenticated API user to consume excessive resources through improperly validated input, causing availability loss. Because exploitation requires PR:H credentials, realistic risk is confined to malicious insiders or post-compromise scenarios; EPSS is 0.32% (23rd percentile) and no public exploit has been identified at time of analysis.
Local code execution affects IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4, where improper bounds checking on the files that store the CECSUB or CECRM objects allows a stack-based buffer overflow and arbitrary code execution on the system. The issue carries a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning an authenticated local user who can already read and write the container files holding CECSUB or CECRM can trigger it with no user interaction and gain full confidentiality, integrity, and availability impact on the host. It is not confirmed actively exploited (no CISA KEV listing), no public exploit code has been identified at time of analysis, and the LOCAL vector plus the specialized z/OS mainframe deployment context make this a high-severity but comparatively low-urgency item under real-world triage.
Stored cross-site scripting in IBM Jazz Foundation - the shared platform underlying IBM Engineering Requirements Management DOORS Next - lets an authenticated, low-privileged user embed arbitrary JavaScript in Web UI fields that is later rendered in another user's browser, potentially disclosing credentials within a trusted session (CVSS 5.4, CWE-79). Affected builds are 7.0.2 through 7.0.2 iFix034, 7.0.3 through 7.0.3 iFix016, and 7.1.0 through 7.1.0 iFix004. Exploitation requires a valid account (PR:L) and a second user who views the injected content (UI:R); no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and there is no KEV listing, making this a second-tier priority rather than an active emergency.
Local privilege escalation in IBM Security Verify Access and Verify Identity Access 10.0.x/11.0.x allows an authenticated local user to obtain root because a component executes with more privileges than required (CWE-250). The flaw affects bare-metal and Docker deployments across 10.0.0.0-10.0.9.0 and 11.0.0.0-11.0.1.0, is local-only (AV:L) and requires existing local credentials under the authoritative assessment, so it cannot be triggered remotely over the network. No public exploit was identified at time of analysis, and IBM has released a vendor patch/advisory.
Security Verify Access and its Docker deployment can be induced to execute malicious scripts sourced from outside the product's control sphere, affecting both interactive and containerized installations in the 10.0.0.0-10.0.9.0 and 11.0.0.0-11.0.1.0 ranges, including Verify Identity Access 11.0.1.0. IBM rates the issue 8.5, but the supplied CVSS vector's PR:N conflicts with the description's requirement for a locally authenticated user, so the authentication prerequisite should be confirmed. No public exploit identified at time of analysis.
Unauthenticated OS command injection in IBM Security Verify Access (including the Docker distribution and Verify Identity Access) versions 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 lets a remote attacker who can reach the affected management/runtime interface execute arbitrary operating-system commands with the privileges of a lower-privileged service account, scored CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Because the injected commands run as a non-root user, confidentiality, integrity and availability impact is limited per-request, but the foothold can be used as a pivot for further privilege escalation against the appliance or container. Impact is bounded to the listed version ranges; IBM has published a vendor fix, and no public exploit code or confirmed active exploitation was identified at time of analysis.
IBM Transformation Extender Advanced 10.0.1 could allow a local user to perform unauthorized actions due to improper access controls.
CVE-2023-49883 is a security vulnerability (CVSS 5.9). Remediation should follow standard vulnerability management procedures.
IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
IBM Transformation Extender Advanced 10.0.1 stores potentially sensitive information in log files that could be read by a local user.
IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized actions. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Lakehouse (watsonx.data 2.2) stores potentially sensitive information in log files that could be read by a local user. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 through 11.1.1 sign session cookies with a hardcoded cryptographic key, so an attacker who recovers that static key can forge trusted cookies and obtain sensitive information. The CVSS vector indicates network exploitation without authentication, but practical exploitation depends on first obtaining the embedded key; EPSS is 0.03% and no public exploit has been identified at time of analysis. IBM has published an advisory at https://www.ibm.com/support/pages/node/7246015.
IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Copy Services Manager 6.3.13 is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks against the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Lakehouse (watsonx.data 2.2) is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: powerpc: Don't try to copy PPR for task with NULL pt_regs powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with root privileges due to improper. Rated high severity (CVSS 7.4), this vulnerability is no authentication required. No vendor patch available.
IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
IBM PowerVM Hypervisor FW950.00 through FW950.E0, FW1050.00 through FW1050.50, and FW1060.00 through FW1060.40 could allow a local privileged user to cause a denial of service by issuing a specially. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files due to improper permission assignment. Rated low severity (CVSS 2.3), this vulnerability is low attack complexity. No vendor patch available.
IBM Fusion (2.2.0 through 2.10.1), IBM Fusion HCI (2.2.0 through 2.10.0), and IBM Fusion HCI for watsonx (2.8.2 through 2.10.0) ship an insecure default configuration that can leave the bundled AMQStreams (Apache Kafka) broker exposed without client authentication, allowing any party with network reachability to publish, consume, or administer topics and cluster metadata without credentials - a full confidentiality, integrity, and availability impact reflected in the 9.8 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-1188). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is only 0.03% (10th percentile), so near-term exploitation likelihood is assessed as low. The practical limiting factor is exposure: AMQStreams is normally an in-cluster OpenShift component, so deployments that already require Kafka client authentication or restrict the listener to internal cluster traffic are not realistically exploitable.
In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a privileged user to escalate their privileges and attack surface on the host due to the containers running with. Rated medium severity (CVSS 6.4). No vendor patch available.
IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a remote user to cause a denial of service due to improper handling of special characters that could lead to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Hardware Management Console - Power 10.3.1050.0 and 11.1.1110.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.