Vulnerabilidades em IBM

4.716 resultados
Análise Vexday

Com 4.716 CVEs catalogadas, o portfólio da IBM acumula um volume expressivo de vulnerabilidades, embora sua taxa de exploração ativa — 5 entradas no catálogo KEV da CISA, representando 0,11% do total — esteja abaixo da média geral do catálogo (0,45%), o que sugere menor aproveitamento ativo em comparação proporcional com outros vendors. A atenção deve se concentrar em CVE-2022-47986, cuja pontuação EPSS de 0,9997 indica probabilidade extremamente elevada de exploração ativa, tornando-a prioridade imediata de mitigação. As 92 CVEs críticas e 18 com PoC pública ampliam a superfície de risco concreto, especialmente considerando que 129 novas vulnerabilidades surgiram nos últimos 90 dias, indicando ritmo relevante de descoberta recente. O tipo de falha mais recorrente, CWE-79 (Cross-Site Scripting), aponta para fragilidades persistentes na camada de apresentação que exigem atenção continuada em práticas de desenvolvimento e validação de entrada.

CVE-2016-5959—IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters. This may lead to information discloEPSS 1.3%CVE-2022-38389HIGHIBM Tivoli Workload Scheduler XML external entity injectionEPSS 1.3%CVE-2020-4203MEDIUMIBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to imprEPSS 1.3%CVE-2020-4815MEDIUMIBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could beEPSS 1.3%CVE-2020-4761MEDIUMIBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker tEPSS 1.3%CVE-2020-4628MEDIUMIBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technicaEPSS 1.3%CVE-2020-4599MEDIUMIBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message iEPSS 1.3%CVE-2020-4907MEDIUMIBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information EPSS 1.3%CVE-2020-4600MEDIUMIBM Security Guardium Insights 2.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message iEPSS 1.3%CVE-2020-4160MEDIUMIBM QRadar Network Security 5.4.0 and 5.5.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properlyEPSS 1.3%CVE-2019-4137MEDIUMIBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embeEPSS 1.3%CVE-2021-29838MEDIUMIBM Security Guardium Insights 3.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HEPSS 1.3%CVE-2018-1608MEDIUMIBM Rational Engineering Lifecycle Manager 6.0 through 6.0.6 uses weaker than expected cryptographic algorithms that could allow an attackerEPSS 1.3%CVE-2019-4568MEDIUMIBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS could allow a remote attacker with intimate knowledge of the server to cause a denial of serviceEPSS 1.3%CVE-2019-4675MEDIUMIBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inboEPSS 1.3%CVE-2020-4573MEDIUMIBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests. IBM EPSS 1.3%CVE-2019-4551MEDIUMIBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality allowing anonymous useEPSS 1.3%CVE-2017-1491—IBM QRadar Network Security 5.4 supports interaction between multiple actors and allows those actors to negotiate which algorithm should be EPSS 1.3%CVE-2024-27268MEDIUMIBM WebSphere Application Server Liberty denial of serviceEPSS 1.3%CVE-2017-1368MEDIUMIBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session EPSS 1.3%