Authorization

IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow an authenticated attacker with authorization to craft messages to cause a denial of service. IBM X-Force ID: 241354...

Code injection

IBM Storage Scale IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through 6.1.6.0 could allow a local user to cause a kernel panic. IBM X-Force ID: 252187...

CVE-2023-22874

CVE-2023-22874 affects IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS, vulnerable to DoS when processing configuration files (CVSS 5.5, LOCAL with UI required). Connected docs confirm the affected MQ client versions and the DoS impact; no exploit details are provided. Remediation path in the linked I...

CVE-2023-22874 IBM MQ denial of service

IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS are vulnerable to a denial of service attack when processing configuration files. IBM X-Force ID: 244216...

CVE-2022-43919 IBM MQ denial of service

IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS could allow an authenticated attacker with authorization to craft messages to cause a denial of service. IBM X-Force ID: 241354...

CVE-2022-38707

IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 234179...

CVE-2023-30434

CVE-2023-30434 affects IBM Spectrum Scale (IBM Storage Scale) and IBM Elastic Storage Systems. A local user could cause a kernel panic in affected releases: IBM Spectrum Scale 5.1.0.0–5.1.2.9 and 5.1.3.0–5.1.6.1; IBM Elastic Storage System 6.1.0.0–6.1.2.5 and 6.1.3.0–6.1.6.0. Root cause is a vuln...

CVE-2023-30434 IBM Storage Scale denial of service

IBM Storage Scale IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through 6.1.6.0 could allow a local user to cause a kernel panic. IBM X-Force ID: 252187...

CVE-2022-38707

CVE-2022-38707 affects IBM Cognos Command Center 10.2.4.1. The issue is an information-disclosure vulnerability caused by insufficient session expiration, enabling a local attacker to obtain sensitive information. The IBM Security bulletin and related sources confirm the weakness and note the imp...

CVE-2022-38707 IBM Cognos Command Center information disclosure

IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 234179...

CVE-2023-23470

IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default configurations, as a result of improper SQL processing. By using a specially crafted SQL operation, the administrator could exploit the vulnerability to perform additional...

Design/Logic Flaw

IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default configurations, as a result of improper SQL processing. By using a specially crafted SQL operation, the administrator could exploit the vulnerability to perform additional...

Privilege escalation

A vulnerability in the IBM TS7700 Management Interface 8.51.2.12, 8.52.200.111, 8.52.102.13, and 8.53.0.63 could allow an authenticated user to submit a specially crafted URL leading to privilege escalation and remote code execution. IBM X-Force ID: 246320...

CVE-2023-23470 IBM i privilege escalation

IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default configurations, as a result of improper SQL processing. By using a specially crafted SQL operation, the administrator could exploit the vulnerability to perform additional...

CVE-2023-23470 IBM i privilege escalation

IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default configurations, as a result of improper SQL processing. By using a specially crafted SQL operation, the administrator could exploit the vulnerability to perform additional...

CVE-2023-23470

CVE-2023-23470 affects IBM i versions 7.2–7.5. An authenticated privileged administrator could gain elevated privileges due to improper SQL processing via a specially crafted SQL operation in non-default configurations. Reported impact: C/H I/H A/H with CVSS v3.1 base score 7.2 (PR:H, UI:N, AV:N)...

CVE-2022-39161

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could...

Spoofing

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could...

CVE-2022-39161

CVE-2022-39161 affects IBM WebSphere Application Server (including Liberty) when using the Web Server Plug-ins, enabling MITM-style spoofing with a certificate from a trusted authority. The vulnerability arises from lack of hostname validation in the plug-in communications, allowing an authentica...

CVE-2022-39161 IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could...