Read the docs

IBM

Records9712All Threatist records
Exploited (KEV)11In CISA KEV
CVSS critical986CVSS 9.0–10.0
CVSS high2776CVSS 7.0–8.9

Exploited now

IBM records in CISA KEV
TI-2026-08085 IBM Langflow Code Injection Vulnerability Priority CRITICAL 100KEV 2026-08-04TI-2022-23774 IBM Aspera Faspex Code Execution Vulnerability Priority CRITICAL 100KEV 2023-02-21TI-2013-03488 IBM InfoSphere BigInsights Invalid Input Vulnerability Priority CRITICAL 88KEV 2022-05-25TI-2014-05157 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2014-05975 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2015-06198 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. Priority CRITICAL 100KEV 2022-01-10

Components

Products in the NVD configurations · select one to filter the records
Aix 545 records CRITICAL Websphere Application Server 503 records CRITICAL Db2 351 records HIGH Vios 237 records HIGH I 208 records HIGH Sterling B2b Integrator 204 records CRITICAL Rational Quality Manager 202 records MEDIUM Qradar Security Information And Event Manager 192 records CRITICAL

Records

13 records in Security Access Manager For Mobile 8.0 Firmware · all components

TI-2014-05975 CVE-2014-7169 · GHSA-f7j6-xrjp-vffg

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed…

Priority CRITICAL 100KEV

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown oth…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9994 Published 2014-09-25 Fixed CWE-78
TI-2014-05157 CVE-2014-6271 · GHSA-6hfc-grwp-2p9c

GNU Bash through 4.3 processes trailing strings after function definitions in the values…

Priority CRITICAL 100KEV

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vec…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2014-09-24 Fixed CWE-78
TI-2014-03963 CVE-2014-4823 · GHSA-hp3h-5542-vq2g

The administration console in IBM Security Access Manager for Web 7.x before…

Priority MEDIUM 48

The administration console in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, and Security Access Manager for Mobile 8.x before 8.0.0-ISS-ISAM-FP0005, allows remot…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.02791 Published 2014-10-03 No fix listed CWE-78
TI-2016-02429 CVE-2016-2908 · GHSA-8xx8-9g4g-c4q2

XML external entity injection in IBM Access Manager

Priority MEDIUM 45

IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.03392 Published 2017-02-01 No fix listed CWE-611
TI-2016-02534 CVE-2016-3029 · GHSA-xjx2-mvvg-4gf4

Cross-site request forgery in IBM Access Manager

Priority LOW 38

IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00454 Published 2017-02-01 No fix listed CWE-352
TI-2016-02532 CVE-2016-3027 · GHSA-q9gv-r7q5-76r2

XML external entity injection in IBM Access Manager

Priority LOW 32

IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data.

CVSS 3.0MEDIUM 6.5 Network High privileges No interaction EPSS 0.01314 Published 2017-02-01 No fix listed CWE-611
TI-2016-02529 CVE-2016-3023 · GHSA-4rv5-wq7q-4wfm

Information disclosure in IBM Access Manager

Priority LOW 26

IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file names.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01129 Published 2017-02-01 No fix listed CWE-200
TI-2014-05012 CVE-2014-6079 · GHSA-vrrh-4jx6-f5j5

Cross-site scripting (XSS) vulnerability in the Local Management Interface in IBM…

Priority LOW 23

Cross-site scripting (XSS) vulnerability in the Local Management Interface in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, and Security Access Manager for Mobil…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01357 Published 2014-10-03 No fix listed CWE-79
TI-2016-02522 CVE-2016-3016 · GHSA-prq3-j8m2-5xg7

Insufficient verification of data authenticity in IBM Access Manager

Priority LOW 20

IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, which could allow an authenticated attacker to load malicious co…

CVSS 3.0MEDIUM 4.4 Network High privileges No interaction EPSS 0.00351 Published 2017-02-01 No fix listed CWE-345
TI-2016-02530 CVE-2016-3024 · GHSA-3q74-6f83-38mg

Information disclosure in IBM Access Manager

Priority LOW 19

IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system.

CVSS 3.0MEDIUM 4.0 Local No auth No interaction EPSS 0.0032 Published 2017-02-01 No fix listed CWE-200
TI-2016-02527 CVE-2016-3021 · GHSA-g5m9-57rf-mghr

Information disclosure in IBM Access Manager

Priority LOW 16

IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP request.

CVSS 3.0LOW 2.7 Network High privileges No interaction EPSS 0.01033 Published 2017-02-01 No fix listed CWE-200
Open these records in search →