WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor ibm✕
Overview 29 matches · 3 in Waratek scope · 3 protected · 11 CISA KEV · 20 public PoC · 15 EPSS ≥ 0.5
29matches 3in Waratek scope10.3% 3protected10.3% 11CISA KEV37.9% 20public PoC69.0% 15EPSS ≥ 0.551.7%
Protected by Waratek 3 10.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 26 89.7% Withdrawn CVE 0 0.0%
Critical 13 44.8% High 10 34.5% Medium 6 20.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 10.3% partly blocked 0 0.0% not blocked 26 89.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 29 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 6 / year
Not applicable: 26Protected by Waratek: 3 Medium: 6High: 10Critical: 13 not blocked: 26blocked by ARMR today: 3 Exploited: 29
20012 Not applicable2 High2 not blocked2 Exploited2 20021 Not applicable1 High1 not blocked1 Exploited1 20032 Not applicable2 High2 not blocked2 Exploited2 20040 20050 20060 20071 Not applicable1 High1 not blocked1 Exploited1 20080 20090 20100 20110 20120 20130 20145 Not applicable5 Critical2 Medium3 not blocked5 Exploited5 20150 20162 Protected by Waratek1 Not applicable1 Critical1 High1 blocked by ARMR today1 not blocked1 Exploited2 20173 Protected by Waratek1 Not applicable2 Critical1 High2 blocked by ARMR today1 not blocked2 Exploited3 20180 20193 Not applicable3 Critical1 Medium2 not blocked3 Exploited3 20206 Protected by Waratek1 Not applicable5 Critical4 High1 Medium1 blocked by ARMR today1 not blocked5 Exploited6 20210 20220 20231 Not applicable1 Critical1 not blocked1 Exploited1 20242 Not applicable2 Critical2 not blocked2 Exploited2 20250 20261 Not applicable1 Critical1 not blocked1 Exploited1
200220052008201120142017202020232026
29 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-123218 Critical 2026-11-07 Not applicable Exploited IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
CVE-2024-22320 Critical 2024-02-02 Not applicable Exploited IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.
CVE-2024-22319 Critical 2024-02-02 Not applicable Exploited IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.
CVE-2022-47986 Critical 2023-02-17 Not applicable Exploited IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
CVE-2020-4463 High 2020-07-29 Not applicable Exploited IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484.
CVE-2020-4450 Critical 2020-06-05 Protected by Waratek Exploited IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181231.
CVE-2020-4430 Medium 2020-05-07 Not applicable Exploited IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535.
CVE-2020-4429 Critical 2020-05-07 Not applicable Exploited IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could exploit this vulnerability to login and execute arbitrary code on the system with root privileges. IBM X-Force ID: 180534.
CVE-2020-4428 Critical 2020-05-07 Not applicable Exploited IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.
CVE-2020-4427 Critical 2020-05-07 Not applicable Exploited IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.
CVE-2019-4716 Critical 2019-12-18 Not applicable Exploited IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
CVE-2019-4061 Medium 2019-02-27 Not applicable Exploited IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associated sites due to not enabling authenticated access. IBM X-Force ID: 156869.
CVE-2018-1932 Medium 2019-01-08 Not applicable Exploited IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175.
CVE-2017-1182 High 2017-07-17 Not applicable Exploited IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to execute arbitrary commands on the system, when default client-server default communications, HTTP, are being used. IBM X-Force ID: 123493.
CVE-2017-1274 High 2017-04-25 Not applicable Exploited IBM Domino 8.5.3, and 9.0 is vulnerable to a stack based overflow in the IMAP service that could allow an authenticated attacker to execute arbitrary code by specifying a large mailbox name. IBM X-Force ID: 124749.
CVE-2017-5638 Critical 2017-03-11 Protected by Waratek Exploited The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVE-2015-7465 High 2016-01-10 Not applicable Exploited Cross-site request forgery (CSRF) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
CVE-2015-7450 Critical 2016-01-02 Protected by Waratek Exploited Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
CVE-2014-7169 Critical 2014-09-25 Not applicable Exploited GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
CVE-2014-6271 Critical 2014-09-24 Not applicable Exploited GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
CVE-2013-3993 Medium 2014-07-07 Not applicable Exploited IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.
CVE-2013-6720 Medium 2014-03-06 Not applicable Exploited Directory traversal vulnerability in download.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to bypass intended access restrictions via a .. (dot dot) in the log parameter, as demonstrated using a crafted request for a customer-support file, as demonstrated by a log file.
CVE-2013-6719 Medium 2014-03-06 Not applicable Exploited delivery.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the testconn_host parameter.
CVE-2007-1675 High 2007-03-28 Not applicable Exploited Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a denial of service via a long username.
CVE-2003-0694 High 2003-10-06 Not applicable Exploited The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.
CVE-2003-0681 High 2003-10-06 Not applicable Exploited A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences.
CVE-2002-1689 High 2002-12-31 Not applicable Exploited Unknown vulnerability in the login program on AIX before 4.0 could allow remote users to specify 100 or more environment variables when logging on, which exceeds the length of a certain string, possibly triggering a buffer overflow.
CVE-2001-0797 High 2001-12-12 Not applicable Exploited Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.
CVE-2001-0554 High 2001-08-14 Not applicable Exploited Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.