Read the docs

IBM

Records9712All Threatist records
Exploited (KEV)11In CISA KEV
CVSS critical986CVSS 9.0–10.0
CVSS high2776CVSS 7.0–8.9

Exploited now

IBM records in CISA KEV
TI-2026-08085 IBM Langflow Code Injection Vulnerability Priority CRITICAL 100KEV 2026-08-04TI-2022-23774 IBM Aspera Faspex Code Execution Vulnerability Priority CRITICAL 100KEV 2023-02-21TI-2013-03488 IBM InfoSphere BigInsights Invalid Input Vulnerability Priority CRITICAL 88KEV 2022-05-25TI-2014-05157 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2014-05975 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2015-06198 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. Priority CRITICAL 100KEV 2022-01-10

Components

Products in the NVD configurations · select one to filter the records
Aix 545 records CRITICAL Websphere Application Server 503 records CRITICAL Db2 351 records HIGH Vios 237 records HIGH I 208 records HIGH Sterling B2b Integrator 204 records CRITICAL Rational Quality Manager 202 records MEDIUM Qradar Security Information And Event Manager 192 records CRITICAL

Records

10 records in Partner Engagement Manager · all components

TI-2021-10455 CVE-2021-29781 · GHSA-5jx2-646m-994c

Deserialization of untrusted data in IBM Partner Engagement Manager

Priority MEDIUM 47

IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02859 Published 2021-07-30 No fix listed CWE-502
TI-2022-06682 CVE-2022-22360 · GHSA-4pr4-pf4q-cm77

Injection in IBM Sterling Partner Engagement Manager

Priority MEDIUM 41

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01689 Published 2022-07-19 No fix listed CWE-74
TI-2022-06680 CVE-2022-22358 · GHSA-gm25-rhmw-47gf

XML external entity injection in IBM Sterling Partner Engagement Manager

Priority LOW 34

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.01253 Published 2022-07-19 No fix listed CWE-611
TI-2022-06660 CVE-2022-22331 · GHSA-4m3m-pj87-8xhf

Authorization bypass in IBM SterlingPartner Engagement Manager

Priority LOW 32

IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability (IDOR).

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00726 Published 2022-04-01 No fix listed CWE-639
TI-2022-06681 CVE-2022-22359 · GHSA-mq7q-47xg-285x

Cross-site request forgery in IBM Sterling Partner Engagement Manager on Cloud

Priority LOW 29

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00297 Published 2022-07-19 No fix listed CWE-352
TI-2022-15256 CVE-2022-34354 · GHSA-vg7q-fc44-5hp4

IBM Sterling Partner Engagement Manager information disclosure

Priority LOW 18

IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00198 Published 2022-11-16 No fix listed CWE-922
Open these records in search →