CVE-2025-2950: Improper Neutralization of HTTP Headers for Scripting Syntax

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior...

PT-2025-17301 · Ibm · Ibm I +1

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.3 through 7.5 Description: The issue is caused by improper neutralization of HTTP header content by IBM Navigator for i, allowing an authenticated user to manipulate the host header in HTTP requests. This can lead to changing...

Security Bulletin: IBM i is vulnerable to a database access denial of service caused by a database capabilities bypass restriction check [CVE-2024-52895].

Summary IBM i is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the remediation/fixes...

CVE-2025-2947

IBM i 7.6 contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the command to elevate privileges to gain root access to the host operating system...

CVE-2025-2947 IBM i privilege escalation

IBM i 7.6 contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the command to elevate privileges to gain root access to the host operating system...

CVE-2025-2947

CVE-2025-2947 affects IBM i 7.6 and describes a privilege-escalation vulnerability caused by incorrect profile swapping in an OS command, enabling a malicious actor to gain root access. The issue is confirmed across multiple feeds (NVD, Red Hat, CVE listing) with a CVSSv3 base score of 7.2 (netwo...

CVE-2025-2947 IBM i privilege escalation

IBM i 7.6 contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the command to elevate privileges to gain root access to the host operating system...

Security Bulletin: IBM i is vulnerable to a privilege escalation due to incorrect profile swapping in an OS command [CVE-2025-2947].

Summary IBM i contains a privilege escalation vulnerability due to incorrect swapping in an OS command as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the remediation/fixes section. Vulnerability Details...

CVE-2025-39436

Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through = 1.0...

CVE-2025-39436

CVE-2025-39436 concerns the WordPress plugin I Draw (versions n/a through 1.0). The issue is Unrestricted Upload of File with Dangerous Type, allowing arbitrary files to be uploaded and used maliciously. Affected component is the plugin’s file upload functionality, with root cause described as al...

CVE-2025-39436 WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw allows Using Malicious Files. This issue affects I Draw: from n/a through 1.0...

CVE-2025-39436 WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through = 1.0...

IBM i security vulnerabilities

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. A security vulnerability exists in IBM i version 7.6 that stems from improper configuration file swapping, which could result in elevated privileges to root...

WordPress plugin “I Draw” has a code vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

CVE-2025-39436: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through = 1.0...

PT-2025-17206 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i version 7.6 Description: The issue is related to a privilege escalation due to incorrect profile swapping in an OS command, allowing a malicious actor to gain root access to the host operating system. Recommendations: For IBM i version...

CVE-2025-2947: Insecure Preserved Inherited Permissions

IBM i 7.6 contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the command to elevate privileges to gain root access to the host operating system...

CVE-2022-43590

A null pointer dereference vulnerability exists in the handleioctl0x830a0systembuffer functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O request packet IRP can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability...

CVE-2022-43589

A null pointer dereference vulnerability exists in the handleioctl8314C functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O request packet IRP can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability...

CVE-2022-43588

A null pointer dereference vulnerability exists in the handleioctl83150 functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O request packet IRP can lead to denial of service. An attacker can issue an ioctl to trigger this vulnerability...