Vulnerabilities in IBM

4,716 results
Vexday analysis

Com 4.716 CVEs catalogadas, o portfólio da IBM acumula um volume expressivo de vulnerabilidades, embora sua taxa de exploração ativa — 5 entradas no catálogo KEV da CISA, representando 0,11% do total — esteja abaixo da média geral do catálogo (0,45%), o que sugere menor aproveitamento ativo em comparação proporcional com outros vendors. A atenção deve se concentrar em CVE-2022-47986, cuja pontuação EPSS de 0,9997 indica probabilidade extremamente elevada de exploração ativa, tornando-a prioridade imediata de mitigação. As 92 CVEs críticas e 18 com PoC pública ampliam a superfície de risco concreto, especialmente considerando que 129 novas vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descoberta recente. O tipo de falha mais recorrente, CWE-79 (Cross-Site Scripting), aponta para fragilidades persistentes na camada de apresentação que exigem atenção continuada em práticas de desenvolvimento e validação de entrada.

CVE-2022-22487MEDIUMAn IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login EPSS 1.4%CVE-2021-39064MEDIUMIBM Spectrum Copy Data Management 2.2.13 and earlier has weak authentication and password rules and incorrectly handles default credentials EPSS 1.4%CVE-2021-29697MEDIUMIBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obEPSS 1.4%CVE-2017-1538—IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive informatioEPSS 1.4%CVE-2019-4722MEDIUMIBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information via a stack trace due to mishandling of cerEPSS 1.4%CVE-2017-1433—IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow an authenticated user to insert messages with a corrupt RFH header into the channel which wouEPSS 1.4%CVE-2020-4236MEDIUMIBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow an authenticated user to cause a denial of service due to improper content paEPSS 1.4%CVE-2018-1997MEDIUMIBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack.EPSS 1.4%CVE-2019-4036HIGHIBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component. IBM EPSS 1.4%CVE-2018-1647HIGHIBM QRadar Incident Forensics 7.2 and 7.3 does not properly restrict the size or amount of resources requested which could allow an unauthenEPSS 1.4%CVE-2021-20470MEDIUMIBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackEPSS 1.4%CVE-2023-25926MEDIUMIBM Security Guardium Key Lifecycle Manager XML external entity injectionEPSS 1.4%CVE-2023-27868MEDIUMIBM Db2 code executionEPSS 1.4%CVE-2023-27869MEDIUMIBM Db2 code executionEPSS 1.4%CVE-2020-4781MEDIUMAn improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which coEPSS 1.4%CVE-2023-27867MEDIUMIBM Db2 code executionEPSS 1.4%CVE-2017-1768MEDIUMIBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environmenEPSS 1.4%CVE-2017-1460—IBM i OSPF 6.1, 7.1, 7.2, and 7.3 is vulnerable when a rogue router spoofs its origin. Routing tables are affected by a missing LSA, which mEPSS 1.4%CVE-2021-29777MEDIUMIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table beEPSS 1.4%CVE-2022-34348HIGHIBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remotEPSS 1.4%