Read the docs

IBM

Records9712All Threatist records
Exploited (KEV)11In CISA KEV
CVSS critical986CVSS 9.0–10.0
CVSS high2776CVSS 7.0–8.9

Exploited now

IBM records in CISA KEV
TI-2026-08085 IBM Langflow Code Injection Vulnerability Priority CRITICAL 100KEV 2026-08-04TI-2022-23774 IBM Aspera Faspex Code Execution Vulnerability Priority CRITICAL 100KEV 2023-02-21TI-2013-03488 IBM InfoSphere BigInsights Invalid Input Vulnerability Priority CRITICAL 88KEV 2022-05-25TI-2014-05157 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2014-05975 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2015-06198 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. Priority CRITICAL 100KEV 2022-01-10

Components

Products in the NVD configurations · select one to filter the records
Aix 545 records CRITICAL Websphere Application Server 503 records CRITICAL Db2 351 records HIGH Vios 237 records HIGH I 208 records HIGH Sterling B2b Integrator 204 records CRITICAL Rational Quality Manager 202 records MEDIUM Qradar Security Information And Event Manager 192 records CRITICAL

Records

54 records in Business Automation Workflow · all components

TI-2022-21536 CVE-2022-43864 · GHSA-rpph-wv52-9mgp

IBM Business Automation Workflow information disclosure

Priority MEDIUM 43

IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0202 Published 2023-01-25 No fix listed CWE-22
TI-2018-01487 CVE-2018-1674 · GHSA-4rp7-9cmg-pcqp

SQL injection in IBM Business Process Manager

Priority MEDIUM 41

IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01695 Published 2018-09-20 No fix listed CWE-89
TI-2019-03267 CVE-2019-4424 · GHSA-pgcf-289q-wwmj

XML external entity injection in IBM Business Automation Workflow

Priority MEDIUM 40

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02427 Published 2019-08-20 No fix listed CWE-611
TI-2018-01730 CVE-2018-2000 · GHSA-j83f-fmmw-wc95

Cross-site request forgery in IBM Business Automation Workflow

Priority LOW 39

IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trus…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00763 Published 2019-04-08 No fix listed CWE-352
TI-2022-20639 CVE-2022-42435 · GHSA-q38h-5r99-h68w

IBM Business Automation Workflow cross-site request forgery

Priority LOW 38

IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to cross-site request forgery which could allow an attacker to exe…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00274 Published 2023-01-03 No fix listed CWE-352
TI-2025-11979 CVE-2025-13096 · GHSA-gpf2-rxq3-v5rj

XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -

Priority LOW 32

IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an X…

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00508 Published 2026-02-02 No fix listed CWE-918
TI-2019-03410 CVE-2019-4669 · GHSA-r67h-45wp-63r3

SQL injection in IBM Business Automation Workflow

Priority LOW 30

IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00835 Published 2020-02-27 No fix listed CWE-89
TI-2024-25595 CVE-2024-38321 · GHSA-f6fc-9fwc-q7rw

IBM Business Automation Workflow information disclosure

Priority LOW 29

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00417 Published 2024-08-03 No fix listed CWE-532
TI-2022-06683 CVE-2022-22361 · GHSA-27g5-8hjj-69w4

Cross-site request forgery in IBM Business Process Manager

Priority LOW 29

IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Business Automation Workflow containers V21.0.1 - V21.0.3 20.0.0.1…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.0036 Published 2022-05-31 No fix listed CWE-352
TI-2018-01643 CVE-2018-1885 · GHSA-px57-9h9g-x6r9

Information disclosure in IBM Business Automation Workflow

Priority LOW 28

IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially cracted HTTP request.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01809 Published 2019-04-08 No fix listed CWE-200
TI-2025-24659 CVE-2025-36054 · GHSA-954p-ff4g-qrwj

Cross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server -

Priority LOW 27

IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 thr…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00212 Published 2025-11-06 No fix listed CWE-79
TI-2022-20122 CVE-2022-41735 · GHSA-m58p-hgqc-5chg

IBM Business Process Manager cross-site scripting

Priority LOW 27

IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00411 Published 2022-12-07 Fixed in 21.0.3.1, 20.0.0.2 +1 CWE-79
TI-2020-03861 CVE-2020-4532 · GHSA-jf7x-r4m4-rqc9

Information disclosure through error messages in IBM Business Process Manager Express

Priority LOW 27

IBM Business Automation Workflow and IBM Business Process Manager (IBM Business Process Manager Express 8.5.5, 8.5.6, 8.5.7, and 8.6) could allow a remote attacker to obtain sensitive information when a detailed technica…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01299 Published 2020-06-17 No fix listed CWE-209
TI-2021-16348 CVE-2021-38893 · GHSA-cjm6-v8hr-j8c5

Cross-site scripting in IBM Cloud Pak for Automation

Priority LOW 26

IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00708 Published 2021-12-21 No fix listed CWE-79
TI-2021-10450 CVE-2021-29775 · GHSA-h89h-g3v3-jc6q

Cross-site scripting in IBM Business Automation Workflow

Priority LOW 26

IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00876 Published 2021-06-28 No fix listed CWE-79
TI-2020-04063 CVE-2020-4794 · GHSA-jq8v-8c7p-26p2

Incorrect authorization in IBM Automation Workstream Services

Priority LOW 26

IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.6 could allow an authenticated user to obtain sensitive information or c…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00849 Published 2020-12-21 No fix listed CWE-863
TI-2020-03849 CVE-2020-4516 · GHSA-fpqw-rp77-mwjr

Cross-site scripting in IBM Business Process Manager

Priority LOW 26

IBM Business Process Manager 8.5, 8.6 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00813 Published 2020-09-08 No fix listed CWE-79
Load more
Open these records in search →