Read the docs

IBM

Records9712All Threatist records
Exploited (KEV)11In CISA KEV
CVSS critical986CVSS 9.0–10.0
CVSS high2776CVSS 7.0–8.9

Exploited now

IBM records in CISA KEV
TI-2026-08085 IBM Langflow Code Injection Vulnerability Priority CRITICAL 100KEV 2026-08-04TI-2022-23774 IBM Aspera Faspex Code Execution Vulnerability Priority CRITICAL 100KEV 2023-02-21TI-2013-03488 IBM InfoSphere BigInsights Invalid Input Vulnerability Priority CRITICAL 88KEV 2022-05-25TI-2014-05157 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2014-05975 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2015-06198 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. Priority CRITICAL 100KEV 2022-01-10

Components

Products in the NVD configurations · select one to filter the records
Aix 545 records CRITICAL Websphere Application Server 503 records CRITICAL Db2 351 records HIGH Vios 237 records HIGH I 208 records HIGH Sterling B2b Integrator 204 records CRITICAL Rational Quality Manager 202 records MEDIUM Qradar Security Information And Event Manager 192 records CRITICAL

Records

9 records in Operational Decision Manager · all components

TI-2024-14906 CVE-2024-22319 · GHSA-x4hh-7hpg-jmcg

IBM Operational Decision Manager JDNI injection

Priority CRITICAL 88

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.764 Published 2024-02-02 No fix listed CWE-74
TI-2024-14907 CVE-2024-22320 · GHSA-5pq5-cp3w-7chj

IBM Operational Decision Manager code execution

Priority CRITICAL 87

IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.73398 Published 2024-02-02 No fix listed CWE-502
TI-2018-01604 CVE-2018-1821 · GHSA-j898-7mvf-jvmr

XML external entity injection in IBM Operational Decision Management

Priority MEDIUM 55

IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.15801 Published 2018-12-13 No fix listed CWE-611
TI-2025-02466 CVE-2025-2824 · GHSA-p3q2-74hc-43v3

IBM Operational Decision Manager HTTP open redirect

Priority LOW 33

IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.0038 Published 2025-08-01 No fix listed CWE-601
TI-2014-00866 CVE-2014-0944 · GHSA-c2x2-37h3-gfvv

Cross-site request forgery (CSRF) vulnerability in the RES Console in Rule Execution…

Priority LOW 28

Cross-site request forgery (CSRF) vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.00726 Published 2014-05-09 No fix listed CWE-352
TI-2025-01337 CVE-2025-1551 · GHSA-qq46-fm3f-6h37

IBM Operational Decision Manager cross-site scripting

Priority LOW 27

IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, and 9.0.0.1 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00263 Published 2025-04-29 No fix listed CWE-79
TI-2014-00868 CVE-2014-0946 · GHSA-3389-xxp5-92p2

The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before…

Priority LOW 24

The RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 does not send appropriate Cache-Control HTTP headers, which allows remote atta…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01845 Published 2014-05-09 No fix listed CWE-200
TI-2014-00867 CVE-2014-0945 · GHSA-p5hp-9rgp-3x5q

Cross-site scripting (XSS) vulnerability in the RES Console in Rule Execution Server in…

Priority LOW 19

Cross-site scripting (XSS) vulnerability in the RES Console in Rule Execution Server in IBM Operational Decision Manager 7.5 before FP3 IF37, 8.0 before MP1 FP2, and 8.5 before MP1 IF26 allows remote authenticated users…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.0118 Published 2014-05-09 No fix listed CWE-79
Open these records in search →