Read the docs

IBM

Records9712All Threatist records
Exploited (KEV)11In CISA KEV
CVSS critical986CVSS 9.0–10.0
CVSS high2776CVSS 7.0–8.9

Exploited now

IBM records in CISA KEV
TI-2026-08085 IBM Langflow Code Injection Vulnerability Priority CRITICAL 100KEV 2026-08-04TI-2022-23774 IBM Aspera Faspex Code Execution Vulnerability Priority CRITICAL 100KEV 2023-02-21TI-2013-03488 IBM InfoSphere BigInsights Invalid Input Vulnerability Priority CRITICAL 88KEV 2022-05-25TI-2014-05157 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2014-05975 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Priority CRITICAL 100KEV 2022-01-28TI-2015-06198 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. Priority CRITICAL 100KEV 2022-01-10

Components

Products in the NVD configurations · select one to filter the records
Aix 545 records CRITICAL Websphere Application Server 503 records CRITICAL Db2 351 records HIGH Vios 237 records HIGH I 208 records HIGH Sterling B2b Integrator 204 records CRITICAL Rational Quality Manager 202 records MEDIUM Qradar Security Information And Event Manager 192 records CRITICAL

Records

18 records in Sterling Partner Engagement Manager · all components

TI-2022-19261 CVE-2022-40615 · GHSA-v3vj-pm98-82mp

IBM Sterling Partner Engagement Manager SQL injection

Priority MEDIUM 43

IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00707 Published 2023-01-11 No fix listed CWE-89
TI-2023-09321 CVE-2023-23482 · GHSA-mh5j-645v-337g

IBM Sterling Partner Engagement Manager clickjacking

Priority MEDIUM 42

IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0061 Published 2023-06-08 No fix listed
TI-2025-24076 CVE-2025-33093 · GHSA-4vv5-fg3j-73p8

IBM Sterling Partner Engagement Manager information disclosure

Priority LOW 39

IBM Sterling Partner Engagement Manager 6.1.0, 6.2.0, 6.2.2 JWT secret is stored in public Helm Charts and is not stored as a Kubernetes secret.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00374 Published 2025-05-07 No fix listed CWE-260
TI-2025-12546 CVE-2025-13726 · GHSA-ghgp-42hg-j6p2

IBM Sterling Partner Engagement Manager Information Disclosure

Priority LOW 39

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00379 Published 2026-03-13 No fix listed CWE-209
TI-2025-12543 CVE-2025-13723 · GHSA-w6pq-fx2g-c9x6

IBM Sterling Partner Engagement Manager Information Disclosure

Priority LOW 38

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive user information using an expired access token

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00193 Published 2026-03-13 No fix listed CWE-324
TI-2023-23064 CVE-2023-43045 · GHSA-vxwp-6hpw-p9g4

IBM Sterling Partner Engagement Manager security bypass

Priority LOW 35

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01101 Published 2023-10-23 No fix listed CWE-288
TI-2022-15252 CVE-2022-34348 · GHSA-xg7c-263c-79vp

XML external entity injection in IBM Partner Engagement Manager

Priority LOW 35

IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.01712 Published 2022-09-23 No fix listed CWE-611
TI-2025-12539 CVE-2025-13718 · GHSA-6jwq-8rqq-hm8r

IBM Sterling Partner Engagement Manager Information Disclosure

Priority LOW 32

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by una…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00212 Published 2026-03-13 No fix listed CWE-319
TI-2022-15244 CVE-2022-34335 · GHSA-rpf3-74p4-xxxj

IBM Sterling Partner Engagement Manager denial of service

Priority LOW 30

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.1 could allow an authenticated user to exhaust server resources which could lead to a denial of service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00732 Published 2023-01-11 No fix listed CWE-400
TI-2022-15243 CVE-2022-34334 · GHSA-w37x-68hw-2gcg

Session fixation in IBM Sterling Partner Engagement Manager

Priority LOW 29

IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00414 Published 2022-10-10 No fix listed CWE-384
TI-2025-12523 CVE-2025-13702 · GHSA-h5cx-22rq-59cj

IBM Sterling Partner Engagement Manager Cross-Site Scripting

Priority LOW 27

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00245 Published 2026-03-13 No fix listed CWE-79
TI-2025-13515 CVE-2025-14811 · GHSA-m2h3-rp3m-p73r

IBM Sterling Partner Engagement Manager Information Disclosure

Priority LOW 26

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which c…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00238 Published 2026-03-13 No fix listed CWE-598
TI-2022-16109 CVE-2022-35640 · GHSA-mx2r-33gr-hh84

IBM Sterling Partner Engagement Manager information disclosure

Priority LOW 24

IBM Sterling Partner Engagement Manager 6.2.2 could allow a local attacker to obtain sensitive information when a detailed technical error message is returned.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00176 Published 2024-07-16 No fix listed CWE-209
Open these records in search →