Read the docs

IBM

Records9712All Threatist records
Exploited (KEV)11In CISA KEV
CVSS critical986CVSS 9.0–10.0
CVSS high2776CVSS 7.0–8.9

Exploited now

IBM records in CISA KEV
TI-2026-08085 IBM Langflow Code Injection Vulnerability Priority CRITICAL 100KEV 2026-08-04TI-2022-23774 IBM Aspera Faspex Code Execution Vulnerability Priority CRITICAL 100KEV 2023-02-21TI-2013-03488 IBM InfoSphere BigInsights Invalid Input Vulnerability Priority CRITICAL 88KEV 2022-05-25TI-2014-05157 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2014-05975 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2015-06198 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. Priority CRITICAL 100KEV 2022-01-10

Components

Products in the NVD configurations · select one to filter the records
Aix 545 records CRITICAL Websphere Application Server 503 records CRITICAL Db2 351 records HIGH Vios 237 records HIGH I 208 records HIGH Sterling B2b Integrator 204 records CRITICAL Rational Quality Manager 202 records MEDIUM Qradar Security Information And Event Manager 192 records CRITICAL

Records

18 records in Aspera Console · all components

TI-2022-21520 CVE-2022-43842 · GHSA-w45p-956p-xwwp

IBM Aspera Console SQL injection

Priority MEDIUM 46

IBM Aspera Console 3.4.0 through 3.4.2 is vulnerable to SQL injection.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00533 Published 2024-02-23 No fix listed CWE-89
TI-2023-12022 CVE-2023-27272 · GHSA-wpfj-mj4c-x9cf

IBM Aspera Console weak password requirements

Priority LOW 38

IBM Aspera Console 3.4.0 through 3.4.4 allows passwords to be reused when a new user logs into the system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00263 Published 2025-04-14 No fix listed CWE-521
TI-2021-16400 CVE-2021-38963 · GHSA-3qcf-857g-5p4x

IBM Aspera Console CSV injection

Priority LOW 38

IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a CSV injection vulnerability.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00638 Published 2024-09-24 No fix listed CWE-1236
TI-2022-21523 CVE-2022-43845 · GHSA-wpw2-69v8-6f9h

IBM Aspera Console information disclosure

Priority LOW 33

IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00425 Published 2024-09-24 No fix listed CWE-1004
TI-2022-21528 CVE-2022-43851 · GHSA-mr22-c455-3h5p

IBM Aspera Console information disclosure

Priority LOW 32

IBM Aspera Console 3.4.0 through 3.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00226 Published 2025-04-14 No fix listed CWE-327
TI-2021-16370 CVE-2021-38927 · GHSA-jfmg-667v-4gmf

IBM Aspera Console cross-site scripting

Priority LOW 32

IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00343 Published 2023-12-25 No fix listed CWE-79
TI-2025-12306 CVE-2025-13460 · GHSA-5r2m-qjqr-rjxf

IBM Aspera Console Information Disclosure

Priority LOW 30

IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00255 Published 2026-03-13 No fix listed CWE-204
TI-2025-12079 CVE-2025-13212 · GHSA-64w9-mhv5-jc6g

IBM Aspera Console Denial of Service

Priority LOW 30

IBM Aspera Console 3.3.0 through 3.4.8 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00287 Published 2026-03-13 No fix listed CWE-799
TI-2022-21529 CVE-2022-43852 · GHSA-fg3p-xv26-qc77

IBM Aspera Console information disclosure

Priority LOW 30

IBM Aspera Console 3.4.0 through 3.4.4 could disclose sensitive information in HTTP headers that could be used in further attacks against the system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00325 Published 2025-04-14 No fix listed CWE-497
TI-2022-21527 CVE-2022-43850 · GHSA-2f7m-3653-hg2p

IBM Aspera Console cross-site scripting

Priority LOW 24

IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0024 Published 2025-04-14 No fix listed CWE-79
TI-2022-21524 CVE-2022-43847 · GHSA-mw36-6r6x-grr2

IBM Aspera Console HTTP header injection

Priority LOW 24

IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0024 Published 2025-04-14 No fix listed CWE-644
TI-2022-21352 CVE-2022-43575

IBM Aspera Console cross-site scripting

Priority LOW 24

IBM Aspera Console 3.4.0 through 3.4.2 PL5 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00249 Published 2024-05-30 No fix listed CWE-79
TI-2022-21186 CVE-2022-43384

IBM Aspera Console cross-site scripting

Priority LOW 24

IBM Aspera Console 3.4.0 through 3.4.2 PL5 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00249 Published 2024-05-30 No fix listed CWE-79
TI-2025-12305 CVE-2025-13459 · GHSA-g886-73cf-92qr

IBM Aspera Console Denial of Service

Priority LOW 23

IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00448 Published 2026-03-13 No fix listed CWE-841
TI-2025-12726 CVE-2025-13925 · GHSA-6hm8-g2pm-5vgv

Multiple vulnerabilities in IBM Aspera Console

Priority LOW 22

IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00341 Published 2026-01-20 No fix listed CWE-532
TI-2022-21518 CVE-2022-43840 · GHSA-gj57-w9c9-x3x9

IBM Aspera Console XPath injection

Priority LOW 20

IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML doc…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00311 Published 2025-04-14 No fix listed CWE-643
TI-2022-21519 CVE-2022-43841

IBM Aspera Console information disclosure

Priority LOW 18

IBM Aspera Console 3.4.0 through 3.4.2 PL9 allows web pages to be stored locally which can be read by another user on the system.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00158 Published 2024-05-30 No fix listed CWE-525
Open these records in search →