53 matches found
Security Bulletin: IBM webMethods Integration Server uses third-party Apache MINA SSHD and Apache MINA Core libraries that are affected CVE-2026-56624
Summary IBM webMethods Integration Server uses third-party Apache MINA SSHD and Apache MINA Core libraries that are affected by CVE-2026-56624. Vulnerability Details CVEID:CVE-2026-56624 DESCRIPTION: Improper certificate validation in Apache MINA SSHD server-side. Apache MINA SSHD is a Java libra...
Security Bulletin: IBM webMethods Integration Sever is affected by multiple CVEs related to Bouncy Castle for Java FIPS jars
Summary IBM webMethods Integration Sever uses third party Bouncy Castle for Java FIPS jars that are affected by multiple CVEs. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X...
Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities
Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the...
Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities
Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java...
Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities
Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.1...
CVE-2026-2310
IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...
CVE-2026-2310: XML Injection (aka Blind XPath Injection)
IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...
PT-2026-89648
IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...
CVE-2026-12118: Deserialization of Untrusted Data
IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data...
CVE-2025-14290: Server-Side Request Forgery (SSRF)
IBM webMethods Integration on prem -Integration Server 10.15 through IS10.15CoreFix2611.1 to IS11.1CoreFix10 IBM webMethods Integration is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to...
CVE-2025-14289: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
IBM webMethods Integration Server 12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
CVE-2025-14150
IBM webMethods Integration on prem - Integration Server 10.15 through IS10.15CoreFix2411.1 to IS11.1CoreFix8 IBM webMethods Integration could disclose sensitive user information in server responses...
CVE-2025-14150
CVE-2025-14150 affects IBM webMethods Integration (on prem) Server versions 10.15 through IS_10.15_Core_Fix24 and 11.1 through IS_11.1_Core_Fix8. Root cause: server responses could disclose sensitive user information. Impact: exposure of sensitive information with network access (vector: network,...
CVE-2025-14150: Exposure of Sensitive System Information to an Unauthorized Control Sphere
IBM webMethods Integration on prem - Integration Server 10.15 through IS10.15CoreFix2411.1 to IS11.1CoreFix8 IBM webMethods Integration could disclose sensitive user information in server responses...
EUVD-2025-198374
IBM webMethods Integration 10.11 through 10.11CoreFix22, 10.15 through 10.15CoreFix22, and 11.1 through 11.1CoreFix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data...
CVE-2025-36072 IBM webMethods Integration Deserialization
IBM webMethods Integration 10.11 through 10.11CoreFix22, 10.15 through 10.15CoreFix22, and 11.1 through 11.1CoreFix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data...
CVE-2025-36072 IBM webMethods Integration Deserialization
IBM webMethods Integration 10.11 through 10.11CoreFix22, 10.15 through 10.15CoreFix22, and 11.1 through 11.1CoreFix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data...
CVE-2025-36072: Deserialization of Untrusted Data
IBM webMethods Integration 10.11 through 10.11CoreFix22, 10.15 through 10.15CoreFix22, and 11.1 through 11.1CoreFix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data...
Security Bulletin: Due to the use of Eclipse JGit, IBM webMethods Integration is affected by denial of service, and other security issues.
Summary Eclipse JGit is used by IBM webMethods Integration in repository function CVE-2025-4949 Vulnerability Details CVEID:CVE-2025-4949 DESCRIPTION: In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implemen...