Overview 673 matches · 40 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 16 public PoC · 3 EPSS ≥ 0.5
673matches
40in Waratek scope5.9%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
16public PoC2.4%
3EPSS ≥ 0.50.4%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
40
5.9%
Outside Waratek scope
7
1.0%
Not applicable
626
93.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
673
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 124 / year
19921
Not applicable1
Low1
not blocked1
No public exploit1
19930
19940
19950
19961
Not applicable1
Low1
not blocked1
No public exploit1
19971
Not applicable1
Low1
not blocked1
Working exploit published1
19982
Not applicable2
Low2
not blocked2
No public exploit2
19994
Not applicable4
Low4
not blocked4
Working exploit published2
No public exploit2
20002
Not applicable2
Low2
not blocked2
Working exploit published1
No public exploit1
20011
Not applicable1
Low1
not blocked1
Working exploit published1
20024
Not applicable4
Low4
not blocked4
Working exploit published1
No public exploit3
20031
No exploit published1
Low1
not blocked1
No public exploit1
20043
Not applicable3
Low3
not blocked3
Working exploit published1
No public exploit2
200511
Not applicable11
Low11
not blocked11
Working exploit published2
No public exploit9
20067
Not applicable7
Low7
not blocked7
Working exploit published1
No public exploit6
20078
Not applicable8
Low8
not blocked8
No public exploit8
20088
No exploit published1
Not applicable7
Low8
not blocked8
No public exploit8
200915
No exploit published8
Not applicable7
Low15
not blocked15
No public exploit15
201016
No exploit published4
Not applicable12
Low16
not blocked16
No public exploit16
201121
No exploit published4
Not applicable17
Low21
not blocked21
No public exploit21
201219
No exploit published3
Not applicable16
Low19
not blocked19
Working exploit published2
No public exploit17
201391
No exploit published7
Outside Waratek scope1
Not applicable83
Low91
not blocked91
No public exploit91
2014124
No exploit published6
Outside Waratek scope1
Not applicable117
Low124
not blocked124
Working exploit published2
Proof of concept only1
No public exploit121
201582
No exploit published1
Outside Waratek scope2
Not applicable79
Low82
not blocked82
Proof of concept only1
Forecast only1
No public exploit80
201647
No exploit published2
Outside Waratek scope1
Not applicable44
Low47
not blocked47
No public exploit47
201739
No exploit published1
Not applicable38
Low39
not blocked39
No public exploit39
201816
Outside Waratek scope1
Not applicable15
Low16
not blocked16
No public exploit16
201922
No exploit published1
Not applicable21
Low22
not blocked22
No public exploit22
202026
No exploit published1
Not applicable25
Low26
not blocked26
No public exploit26
202123
Outside Waratek scope1
Not applicable22
Low23
not blocked23
No public exploit23
202210
Not applicable10
Low10
not blocked10
No public exploit10
20234
Not applicable4
Low4
not blocked4
No public exploit4
202410
Not applicable10
Low10
not blocked10
No public exploit10
202524
Not applicable24
Low24
not blocked24
Proof of concept only1
No public exploit23
202630
Not applicable30
Low30
not blocked30
No public exploit30
199319961999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-84237 | Low | 2026-11-08 | Not applicable | No public exploit | IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. |
| CVE-2026-84228 | Low | 2026-11-08 | Not applicable | No public exploit | IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. |
| CVE-2026-18194 | Low | 2026-11-08 | Not applicable | No public exploit | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls. |
| CVE-2026-17062 | Low | 2026-11-07 | Not applicable | No public exploit | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify internal requests due to improper neutralization of argument delimiters. Special characters in user-supplied input are not handled safely, which could allow additional parameters to be added to a request made by the server. |
| CVE-2026-3303 | Low | 2026-10-19 | Not applicable | No public exploit | IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains. |
| CVE-2026-1501 | Low | 2026-10-19 | Not applicable | No public exploit | IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation. |
| CVE-2026-12660 | Low | 2026-10-19 | Not applicable | No public exploit | IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation. |
| CVE-2026-19492 | Low | 2026-09-24 | Not applicable | No public exploit | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a hypervisor call interface. An attacker with root access to a guest partition can read a limited amount of hypervisor memory, potentially exposing sensitive data belonging to the hypervisor or other guest partitions hosted on the same system, resulting in a confidentiality impact. The attacker has no control over which memory contents are returned. This vulnerability is of particular concern in multi-tenant environments where guests may run arbitrary OS images. |
| CVE-2026-18857 | Low | 2026-09-24 | Not applicable | No public exploit | IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system. |
| CVE-2026-18104 | Low | 2026-09-24 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption. |
| CVE-2026-17511 | Low | 2026-09-24 | Not applicable | No public exploit | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition resource dump interface. An attacker with authenticated administrator-level access to the HMC or service processor can obtain a limited snapshot of partition processor state. Successful exploitation results in a confidentiality impact to the managed system. |
| CVE-2026-4921 | Low | 2026-09-23 | Not applicable | No public exploit | IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2026-18173 | Low | 2026-09-22 | Not applicable | No public exploit | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication. |
| CVE-2026-16891 | Low | 2026-08-19 | Not applicable | No public exploit | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read. |
| CVE-2026-16890 | Low | 2026-08-19 | Not applicable | No public exploit | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an integer overflow. |
| CVE-2026-16888 | Low | 2026-08-19 | Not applicable | No public exploit | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to a path traversal vulnerability. |
| CVE-2026-17071 | Low | 2026-08-13 | Not applicable | No public exploit | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal. |
| CVE-2026-17043 | Low | 2026-08-13 | Not applicable | No public exploit | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. |
| CVE-2026-18096 | Low | 2026-08-12 | Not applicable | No public exploit | IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak. |
| CVE-2026-11937 | Low | 2026-08-12 | Not applicable | No public exploit | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM Security Verify Access Container 10.0 through 10.0.9.2 Reverse Proxy in certain configurations is vulnerable to a denial of service attack. |
| CVE-2026-12730 | Low | 2026-08-05 | Not applicable | No public exploit | IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server. |
| CVE-2025-14808 | Low | 2026-03-25 | Not applicable | No public exploit | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques. |
| CVE-2025-36183 | Low | 2026-02-17 | Not applicable | No public exploit | IBM watsonx.data 2.2 through 2.2.1 IBM Lakehouse could allow a privileged user to upload malicious files that could be executed server to modify limited files or data. |
| CVE-2025-27550 | Low | 2026-02-04 | Not applicable | No public exploit | IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about other projects that reside on the server. |
| CVE-2025-2134 | Low | 2026-02-04 | Not applicable | No public exploit | IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient resource pooling. |
| CVE-2025-1823 | Low | 2026-02-04 | Not applicable | No public exploit | IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using specially crafted SQL query that consumes excess memory resources. |
| CVE-2025-36194 | Low | 2026-02-02 | Not applicable | No public exploit | IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 may expose a limited amount of data to a peer partition in specific shared processor configurations during certain operations. |
| CVE-2025-36411 | Low | 2026-01-20 | Not applicable | No public exploit | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. |
| CVE-2026-0992 | Low | 2026-01-15 | Not applicable | No public exploit | A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition. |
| CVE-2026-0989 | Low | 2026-01-15 | Not applicable | No public exploit | A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk. |
| CVE-2025-36228 | Low | 2025-12-26 | Not applicable | No public exploit | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse. |
| CVE-2024-56464 | Low | 2025-12-09 | Not applicable | No public exploit | IBM QRadar SIEM 7.5 - 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed this vulnerability in the latest update. |
| CVE-2025-36102 | Low | 2025-12-08 | Not applicable | No public exploit | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input into the application as trusted data, due to client-side enforcement of server-side security. |
| CVE-2025-2529 | Low | 2025-10-15 | Not applicable | No public exploit | Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application using Ehcache utilizes keys sourced from (malicious) external parties in an unfiltered/unsalted way. |
| CVE-2025-2139 | Low | 2025-10-12 | Not applicable | No public exploit | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security. |
| CVE-2025-2138 | Low | 2025-10-12 | Not applicable | No public exploit | IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of server-side security. |
| CVE-2025-0164 | Low | 2025-09-14 | Not applicable | No public exploit | IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on configuration files due to improper permission assignment. |
| CVE-2025-8732 | Low | 2025-08-08 | Not applicable | No public exploit | A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all." |
| CVE-2025-25046 | Low | 2025-04-23 | Not applicable | No public exploit | IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be exposed to an unauthorized actor using man in the middle techniques. |
| CVE-2024-41760 | Low | 2025-03-11 | Not applicable | No public exploit | IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an attacker to obtain sensitive information due to a timing attack during certain RSA operations. |
| CVE-2024-52905 | Low | 2025-03-10 | Not applicable | No public exploit | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 could disclose sensitive database information to a privileged user. |
| CVE-2025-0895 | Low | 2025-03-02 | Not applicable | No public exploit | IBM Cognos Analytics Mobile 1.1 for Android could allow a user with physical access to the device, to obtain sensitive information from debugging code log messages. |
| CVE-2025-0759 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization. |
| CVE-2024-56811 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56810 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56496 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56495 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56494 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-56493 | Low | 2025-02-27 | Not applicable | No public exploit | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-45674 | Low | 2025-02-22 | Not applicable | No public exploit | IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores potentially sensitive information in log files that could be read by a local user. |
| CVE-2024-56467 | Low | 2025-02-06 | Not applicable | Proof of concept only | IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. |
| CVE-2024-35122 | Low | 2025-01-24 | Not applicable | No public exploit | IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to a file level local denial of service caused by an insufficient authority requirement. A local non-privileged user can configure a referential constraint with the privileges of a user socially engineered to access the target file. |
| CVE-2021-20455 | Low | 2025-01-07 | Not applicable | No public exploit | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. |
| CVE-2024-51472 | Low | 2025-01-06 | Not applicable | No public exploit | IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. |
| CVE-2024-49820 | Low | 2024-12-17 | Not applicable | No public exploit | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. |
| CVE-2023-37395 | Low | 2024-12-11 | Not applicable | No public exploit | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. |
| CVE-2024-43173 | Low | 2024-10-22 | Not applicable | No public exploit | IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. |
| CVE-2023-42010 | Low | 2024-07-17 | Not applicable | No public exploit | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 could disclose sensitive information in the HTTP response using man in the middle techniques. IBM X-Force ID: 265507. |
| CVE-2023-35022 | Low | 2024-06-30 | Not applicable | No public exploit | IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254. |
| CVE-2024-31870 | Low | 2024-06-15 | Not applicable | No public exploit | IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having authority to the related *USRPRF objects. This can be used by a malicious actor to gather information about users that can be targeted in further attacks. IBM X-Force ID: 287174. |
| CVE-2024-22333 | Low | 2024-06-13 | Not applicable | No public exploit | IBM Maximo Asset Management 7.6.1.3 and IBM Maximo Application Suite 8.10 and 8.11 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 279973. |
| CVE-2023-33855 | Low | 2024-03-26 | Not applicable | No public exploit | Under certain conditions, RSA operations performed by IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 may exhibit non-constant-time behavior. This could allow a remote attacker to obtain sensitive information using a timing-based attack. IBM X-Force ID: 257676. |
| CVE-2022-32756 | Low | 2024-03-22 | Not applicable | No public exploit | IBM Security Verify Directory 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 228507. |
| CVE-2023-50955 | Low | 2024-02-21 | Not applicable | No public exploit | IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installation which could aid in further attacks against the system. IBM X-Force ID: 275777. |
| CVE-2023-33833 | Low | 2023-08-31 | Not applicable | No public exploit | IBM Security Verify Information Queue 10.0.4 and 10.0.5 stores sensitive information in plain clear text which can be read by a local user. IBM X-Force ID: 256013. |
| CVE-2023-33847 | Low | 2023-06-08 | Not applicable | No public exploit | IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 257102. |
| CVE-2023-33849 | Low | 2023-06-07 | Not applicable | No public exploit | IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 could transmit sensitive information in query parameters that could be intercepted using man in the middle techniques. IBM X-Force ID: 257105. |
| CVE-2023-22591 | Low | 2023-03-15 | Not applicable | No public exploit | IBM Robotic Process Automation 21.0.1 through 21.0.7 and 23.0.0 through 23.0.1 could allow a user with physical access to the system due to session tokens for not being invalidated after a password reset. IBM X-Force ID: 243710. |
| CVE-2022-42442 | Low | 2022-11-03 | Not applicable | No public exploit | IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to users with access to the container platform. IBM X-Force ID: 238214. |
| CVE-2022-22314 | Low | 2022-09-08 | Not applicable | No public exploit | IBM Planning Analytics Local 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 217371. |
| CVE-2022-22326 | Low | 2022-08-01 | Not applicable | No public exploit | IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856. |
| CVE-2022-22450 | Low | 2022-07-14 | Not applicable | No public exploit | IBM Security Verify Identity Manager 10.0 could allow a privileged user to upload a malicious file by bypassing extension security in an HTTP request. IBM X-Force ID: 224916. |
| CVE-2021-20551 | Low | 2022-06-24 | Not applicable | No public exploit | IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 199149. |
| CVE-2022-22426 | Low | 2022-06-10 | Not applicable | No public exploit | IBM Spectrum Copy Data Management Admin 2.2.0.0 through 2.2.15.0 could allow a local attacker to bypass authentication restrictions, caused by the lack of proper session management. An attacker could exploit this vulnerability to bypass authentication and gain unauthorized access to the Spectrum Copy Data Management catalog which contains metadata. IBM X-Force ID: 223718. |
| CVE-2022-22348 | Low | 2022-03-14 | Not applicable | No public exploit | IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Operations Center to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Once clicked, that malicious URL could then rewrite the original page with a phishing page. IBM X-Force ID: 220139. |
| CVE-2019-4352 | Low | 2022-02-16 | Not applicable | No public exploit | IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494. |
| CVE-2021-29846 | Low | 2022-01-26 | Not applicable | No public exploit | IBM Security Guardium Insights 3.0 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 205256. |
| CVE-2021-38894 | Low | 2022-01-10 | Not applicable | No public exploit | IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 209515. |
| CVE-2021-38973 | Low | 2021-11-12 | Not applicable | No public exploit | IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CVE-2020-4951 | Low | 2021-10-15 | Outside Waratek scope | No public exploit | IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive information. |
| CVE-2021-20377 | Low | 2021-09-23 | Not applicable | No public exploit | IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195569. |
| CVE-2020-4809 | Low | 2021-09-23 | Not applicable | No public exploit | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633. |
| CVE-2020-4805 | Low | 2021-09-23 | Not applicable | No public exploit | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539. |
| CVE-2020-4803 | Low | 2021-09-23 | Not applicable | No public exploit | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535. |
| CVE-2021-20478 | Low | 2021-07-20 | Not applicable | No public exploit | IBM Cloud Pak System 2.3 could allow a local user in some situations to view the artifacts of another user in self service console. IBM X-Force ID: 197497. |
| CVE-2021-20534 | Low | 2021-07-15 | Not applicable | No public exploit | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 198814 |
| CVE-2021-20523 | Low | 2021-07-15 | Not applicable | No public exploit | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 198660 |
| CVE-2021-20499 | Low | 2021-07-15 | Not applicable | No public exploit | IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 197973 |
| CVE-2021-29759 | Low | 2021-07-07 | Not applicable | No public exploit | IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, and 1.3 could allow a privileged user to obtain sensitive information from internal log files. IBM X-Force ID: 202212. |
| CVE-2021-20396 | Low | 2021-06-11 | Not applicable | No public exploit | IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 196009. |
| CVE-2021-20575 | Low | 2021-06-01 | Not applicable | No public exploit | IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278. |
| CVE-2020-4765 | Low | 2021-05-19 | Not applicable | No public exploit | IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188902. |
| CVE-2021-20391 | Low | 2021-05-14 | Not applicable | No public exploit | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 195999. |
| CVE-2020-4811 | Low | 2021-05-14 | Not applicable | No public exploit | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious data using a specially crafted HTTP request due to improper input validation. |
| CVE-2021-29671 | Low | 2021-04-09 | Not applicable | No public exploit | IBM Spectrum Scale 5.1.0.1 could allow a local attacker to bypass the filesystem audit logging mechanism when file audit logging is enabled. IBM X-Force ID: 199478. |
| CVE-2020-4726 | Low | 2021-03-02 | Not applicable | No public exploit | The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 187975. |
| CVE-2020-4725 | Low | 2021-03-02 | Not applicable | No public exploit | IBM Monitoring (IBM Cloud APM 8.1.4 ) could allow an authenticated user to modify HTML content by sending a specially crafted HTTP request to the APM UI, which could mislead another user. IBM X-Force ID: 187974. |
| CVE-2021-20402 | Low | 2021-02-11 | Not applicable | No public exploit | IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196076. |
| CVE-2020-4787 | Low | 2021-01-27 | Not applicable | No public exploit | IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 189224. |
| CVE-2020-4889 | Low | 2021-01-26 | Not applicable | No public exploit | IBM Spectrum Scale 5.0.0 through 5.0.5.4 and 5.1.0 could allow a local user to poison log files which could impact support and development efforts. IBM X-Force ID: 190971. |