Vulnerabilities in IBM

5,658 results
Vexday analysis

Com 4.716 CVEs catalogadas, o portfólio da IBM acumula um volume expressivo de vulnerabilidades, embora sua taxa de exploração ativa — 5 entradas no catálogo KEV da CISA, representando 0,11% do total — esteja abaixo da média geral do catálogo (0,45%), o que sugere menor aproveitamento ativo em comparação proporcional com outros vendors. A atenção deve se concentrar em CVE-2022-47986, cuja pontuação EPSS de 0,9997 indica probabilidade extremamente elevada de exploração ativa, tornando-a prioridade imediata de mitigação. As 92 CVEs críticas e 18 com PoC pública ampliam a superfície de risco concreto, especialmente considerando que 129 novas vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descoberta recente. O tipo de falha mais recorrente, CWE-79 (Cross-Site Scripting), aponta para fragilidades persistentes na camada de apresentação que exigem atenção continuada em práticas de desenvolvimento e validação de entrada.

CVE-2023-28525MEDIUMIBM Engineering Requirements Management cross-site scriptingEPSS 0.3%CVE-2019-4236MEDIUMA IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACLEPSS 0.3%CVE-2025-36099MEDIUMIBM WebSphere Application Server denial of serviceEPSS 0.3%CVE-2023-40367MEDIUMIBM QRadar SIEM cross-site scriptingEPSS 0.3%CVE-2023-38722MEDIUMIBM Sterling Partner Engagement Manager cross-site scriptingEPSS 0.3%CVE-2023-38281MEDIUMMultiple Vulnerabilities in IBM Cloud Pak SystemEPSS 0.3%CVE-2024-43177MEDIUMIBM Concert improper certificate validationEPSS 0.3%CVE-2018-1377—IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores user credentials in plain in clear text which can be read by a local user. IEPSS 0.3%CVE-2017-1270—IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijackinEPSS 0.3%CVE-2025-36171MEDIUMIBM Aspera Faspex denial of serviceEPSS 0.3%CVE-2019-4133MEDIUMIBM Cloud Automation Manager 3.1.2 could allow a malicious user on the client side (with access to client computer) to run a custom script. EPSS 0.3%CVE-2024-56342MEDIUMIBM Verify Identity Access Digital Credentials information disclosureEPSS 0.3%CVE-2023-47714MEDIUMIBM Sterling File Gateway cross-site scriptingEPSS 0.3%CVE-2020-4492MEDIUMIBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a denial of service crashiEPSS 0.3%CVE-2019-4619MEDIUMIBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclEPSS 0.3%CVE-2026-18891HIGHLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilitiesEPSS 0.3%CVE-2024-45640MEDIUMIBM Security QRadar EDR information disclosureEPSS 0.3%CVE-2019-4719MEDIUMIBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclEPSS 0.3%CVE-2022-40744MEDIUMIBM Aspera Faspex cross-site scriptingEPSS 0.3%CVE-2019-4298HIGHIBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow aEPSS 0.3%