CVE-2025-36100

CVE-2025-36100 affects IBM MQ LTS and CD client components where enabling trace stores a password in client configuration files that a local user can read. The IBM bulletin details affected MQ LTS versions (9.1.0.0–9.1.0.29, 9.2.0.0–9.2.0.36, 9.3.0.0–9.3.0.30, 9.4.0.0–9.4.0.12) and MQ CD (9.3.0.0...

CVE-2025-36100 IBM MQ information disclosure

IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0 Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2025-32415 DESCRIPTION: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploi...

IBM MQ 9.2 < 9.2.0.37 LTS / 9.3 < 9.3.0.31 LTS / 9.3 < 9.4.3.1 CD / 9.4 < 9.4.0.15 LTS / 9.4.3.1 (7243544)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7243544 advisory. - IBM MQ Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user. CWE: CWE-260: Password in Configuration File...

IBM MQ 9.1 < 9.1.0.31 LTS / 9.2 < 9.2.0.37 LTS / 9.3 < 9.3.0.31 LTS / 9.3 < 9.4.3.1 CD / 9.4 < 9.4.0.15 LTS / 9.4.3.1 (7243799)

The version of IBM MQ Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7243799 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that...

IBM MQ 9.1 < 9.1.0.31 LTS / 9.2 < 9.2.0.37 LTS / 9.3 < 9.3.0.31 LTS / 9.3 < 9.4.3.1 CD / 9.4 < 9.4.0.15 LTS / 9.4.3.1 (7243800)

The version of IBM MQ Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7243800 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that...

Security Bulletin: IBM MQ is vulnerable to a password disclosure vulnerability.

Summary IBM MQ has addressed a password disclosure vulnerability CVE-2025-36100 Vulnerability Details CVEID:CVE-2025-36100 DESCRIPTION: IBM MQ Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user. CWE:CWE-260: Password in Configurati...

Linux Distros Unpatched Vulnerability : CVE-2018-8006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveM...

Malicious code in koa-mq (npm)

The package koa-mq was found to contain malicious code...

MAL-2025-21162 Malicious code in gama-mq (npm)

The package gama-mq was found to contain malicious code...

Malicious code in gama-mq (npm)

The package gama-mq was found to contain malicious code...

MAL-2025-24716 Malicious code in koa-mq (npm)

The package koa-mq was found to contain malicious code...

Linux Distros Unpatched Vulnerability : CVE-2025-37842

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: fsl-qspi: use devm function instead of driver remove Driver use devm APIs to manage clk/irq/resources and register the spi controller, but the legacy remov...

CVE-2025-33013

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release...

CVE-2025-36005

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the...

CVE-2025-36005

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the...

CVE-2025-33013

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release...

CVE-2025-33013

CVE-2025-33013 affects IBM MQ Operator and related container images. The issue is information disclosure caused by improper clearing of heap memory before release, exploitable by a local user. Affected versions include IBM MQ Operator LTS 2.0.0–2.0.29, MQ Operator CD 3.0.0–3.0.1, 3.1.0–3.1.3, 3.3...

CVE-2025-33013 IBM MQ Operator information disclosure

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release...

CVE-2025-33013 IBM MQ Operator information disclosure

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Container could disclose sensitive information to a local user due to improper clearing of heap memory before release...