Read the docs

IBM

Records9712All Threatist records
Exploited (KEV)11In CISA KEV
CVSS critical986CVSS 9.0–10.0
CVSS high2776CVSS 7.0–8.9

Exploited now

IBM records in CISA KEV
TI-2026-08085 IBM Langflow Code Injection Vulnerability Priority CRITICAL 100KEV 2026-08-04TI-2022-23774 IBM Aspera Faspex Code Execution Vulnerability Priority CRITICAL 100KEV 2023-02-21TI-2013-03488 IBM InfoSphere BigInsights Invalid Input Vulnerability Priority CRITICAL 88KEV 2022-05-25TI-2014-05157 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2014-05975 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2015-06198 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. Priority CRITICAL 100KEV 2022-01-10

Components

Products in the NVD configurations · select one to filter the records
Aix 545 records CRITICAL Websphere Application Server 503 records CRITICAL Db2 351 records HIGH Vios 237 records HIGH I 208 records HIGH Sterling B2b Integrator 204 records CRITICAL Rational Quality Manager 202 records MEDIUM Qradar Security Information And Event Manager 192 records CRITICAL

Records

41 records in Cloud Pak System · all components

TI-2019-03317 CVE-2019-4521 · GHSA-hp2p-gr52-7qp5

CSV injection in IBM Cloud Pak System

Priority MEDIUM 47

Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02612 Published 2019-12-10 No fix listed CWE-1236
TI-2019-03082 CVE-2019-4130 · GHSA-2mp2-8rhv-p755

Unrestricted file upload in IBM Cloud Pak System

Priority MEDIUM 42

IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01957 Published 2019-12-03 No fix listed CWE-434
TI-2023-19680 CVE-2023-38273 · GHSA-283h-3w9j-26xq

IBM Cloud Pak System information disclosure

Priority MEDIUM 40

IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00674 Published 2024-02-02 No fix listed CWE-307
TI-2023-20061 CVE-2023-38716 · GHSA-c52r-r6j6-x3c5

IBM Cloud Pak System information disclosure

Priority LOW 39

IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further attacks against the system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00333 Published 2025-01-25 No fix listed CWE-209
TI-2023-20060 CVE-2023-38714 · GHSA-qjp6-cp7g-v8xv

IBM Cloud Pak System information disclosure

Priority LOW 39

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further at…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0033 Published 2025-01-25 No fix listed CWE-209
TI-2023-20059 CVE-2023-38713 · GHSA-vqrh-582c-2w2r

IBM Cloud Pak System information disclosure

Priority LOW 39

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further at…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0033 Published 2025-01-25 No fix listed CWE-209
TI-2023-19441 CVE-2023-38013 · GHSA-m2fr-34qc-xrjj

IBM Cloud Pak System information disclosure

Priority LOW 39

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further a…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0033 Published 2025-01-25 No fix listed CWE-201
TI-2023-19439 CVE-2023-38010 · GHSA-23xf-jw4c-q879

Multiple Vulnerabilities in IBM Cloud Pak System

Priority LOW 39

IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00324 Published 2026-02-04 No fix listed CWE-209
TI-2020-04144 CVE-2020-4917 · GHSA-mv6x-4xh6-87hm

Cross-site request forgery in IBM Cloud Pak System

Priority LOW 38

IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0043 Published 2021-01-04 No fix listed CWE-352
TI-2021-03730 CVE-2021-20479 · GHSA-xr5m-vqc6-vc94

Broken or risky cryptographic algorithm in IBM Cloud Pak System

Priority LOW 34

IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00665 Published 2022-05-09 No fix listed CWE-327
TI-2023-19679 CVE-2023-38272 · GHSA-w7fp-pj56-6xc6

IBM Cloud Pak System information disclosure

Priority LOW 33

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 could allow a user with access to the network to obtain sensitive…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00353 Published 2025-03-27 No fix listed CWE-300
TI-2026-76515 CVE-2026-3295 · GHSA-g698-cvpw-9x59

Stored cross-site scripting in IBM Cloud Pak System

Priority LOW 32

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.00177 Published 2026-10-19 No fix listed CWE-79
TI-2026-76514 CVE-2026-3161 · GHSA-2pff-h2q8-4jc4

Risky cryptographic algorithm in IBM Cloud Pak System

Priority LOW 32

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00171 Published 2026-10-19 No fix listed CWE-327
TI-2023-19440 CVE-2023-38012 · GHSA-j7vf-q996-69xm

IBM Cloud Pak System directory traversal

Priority LOW 31

IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00514 Published 2025-01-25 No fix listed CWE-22
TI-2023-19684 CVE-2023-38281 · GHSA-6jv7-gp56-rq3m

Multiple Vulnerabilities in IBM Cloud Pak System

Priority LOW 30

IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00317 Published 2026-02-04 No fix listed CWE-209
TI-2020-04152 CVE-2020-4928 · GHSA-j684-c6q4-x85p

Unrestricted file upload in IBM Cloud Pak System

Priority LOW 30

IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00368 Published 2021-01-04 No fix listed CWE-434
TI-2023-19678 CVE-2023-38271 · GHSA-jfx2-4jj8-x2wj

IBM Cloud Pak System information disclosure

Priority LOW 29

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to obtain sensitive information from log files.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00321 Published 2025-01-25 No fix listed CWE-532
TI-2023-19023 CVE-2023-37405 · GHSA-56r2-5qqm-ppfv

IBM Cloud Pak System information disclosure

Priority LOW 28

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stores sensitive data in memory, that could be obtained by an una…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00238 Published 2025-03-27 No fix listed CWE-311
TI-2023-30889 CVE-2023-38375 · GHSA-qcpj-652c-hcfv

Cross-site scripting in IBM Cloud Pak System Web UI

Priority LOW 27

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00194 Published 2026-10-19 No fix listed CWE-79
TI-2019-03294 CVE-2019-4468 · GHSA-6q44-g7gx-xp5f

Cross-site scripting in IBM Cloud Pak System

Priority LOW 25

IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00561 Published 2019-12-03 No fix listed CWE-79
TI-2019-03293 CVE-2019-4467 · GHSA-x8h6-fqp3-v7qr

Cross-site scripting in IBM Cloud Pak System

Priority LOW 25

IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00561 Published 2019-12-03 No fix listed CWE-79
Load more
Open these records in search →