CVE-2025-36041

CVE-2025-36041 IBM MQ SSL 绕过利用工具 概述 本仓库包含针对 CVE-2025-36041 的概念验证（PoC）利用代码，该漏洞存在于 IBM MQ（消息队列）中，允许绕过 SSL 证书验证。通过注入伪造的 SSL 证书并使用定制的 MQCONNX 参数，可以建立未经授权的客户端与 IBM MQ 服务器的连接。 功能 SSL 绕过 ：注入伪造的 SSL KeyRepository 以禁用服务器证书验证。 自动化利用 ：打开指定队列并发送测试消息（"Hello MQ"）以确认利用成功。 可定制 ：通过命令行参数指定目标队列管理器、队列名称以及伪造 SSL 仓库的路...

Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images

Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2026-75104 DESCRIPTION: Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers c...

Security Bulletin: IBM MQ Appliance is affected by an XML external entity vulnerability (CVE-2026-13287)

Summary IBM MQ Appliance has addressed an XML external entity XXE vulnerability in the Managed File Transfer monitor result parser Vulnerability Details CVEID:CVE-2026-13287 DESCRIPTION: IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 throu...

Vulnerabilities found in IBM Langflow OSS and IBM MQ Appliance

IBM has identified 12 vulnerabilities in IBM MQ, IBM MQ Appliance, and Langflow OSS. These vulnerabilities could allow for the execution of arbitrary code or commands. Four of these vulnerabilities are classified as critical and can be exploited without authentication or user interaction. The...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-11979 DESCRIPTION: libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell functi...

CVE-2026-11727

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...

CVE-2026-11725

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing...

CVE-2026-11726

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values...

CVE-2026-11716

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data...

CVE-2026-11727 IBM MQ for HPE NonStop is vulnerable to a denial of service issue

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...

CVE-2026-11727 IBM MQ for HPE NonStop is vulnerable to a denial of service issue

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...

EUVD-2026-83294

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...

CVE-2026-11727

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 and IBM MQ 9.1 through 10.0.0.0 (Standard Client) are affected by a heap-based buffer overflow (CWE-122) in the MQ client's MQOPEN reply handler . Improper validation of queue manager responses when requesting AMS policy data allows a rogue queue mana...

CVE-2026-11726 IBM MQ for HPE NonStop is vulnerable to a denial of service issue

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values...

EUVD-2026-83293

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values...

CVE-2026-11726 IBM MQ for HPE NonStop is vulnerable to a denial of service issue

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values...

CVE-2026-11726

IBM MQ across multiple platforms (queue manager, HPE NonStop , and MQ Appliance ) is affected by improper validation of message header offset values (CWE-125: Out-of-bounds Read), allowing a remote authenticated attacker to read heap memory or cause a denial of service via crafted messages. The r...

CVE-2026-11725 IBM MQ queue manager is vulnerable to privilege escalation

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing...

CVE-2026-11725 IBM MQ queue manager is vulnerable to privilege escalation

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing...

CVE-2026-11725

IBM MQ queue manager is vulnerable to an integer overflow (CWE-190) in MQINQ request validation , allowing an authenticated attacker to cause a denial of service or potentially execute arbitrary code. The affected versions span IBM MQ 9.1 LTS through 10.0.0.0 (Server component) and IBM MQ Applian...