37820 matches found
Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-8408)
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-10842)
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability (CVE-2026-15057)
Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability due to uncontrolled heap allocation caused by an out-of-bounds write when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 and with the HTTP/2 protocol enabled. Vulnerability Detail...
Security Bulletin: IBM Integration Bus for z/OS is vulnerable to Improper Handling of URL Encoding and Insufficient Technical Documentation due to Apache Tomcat (CVE-2026-59083 & CVE-2026-59084)
Summary IBM Integration Bus for z/OS is vulnerable to Improper Handling of URL Encoding and Insufficient Technical Documentation due to Apache Tomcat. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite...
Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j API and jackson-databind
Summary IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j API and jackson-databind. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...
Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server
Summary IBM Db2 is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM Db2 have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affect...
Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by multiple vulnerabilities (CVE-2026-11712, CVE-2026-11595, CVE-2026-11708)
Summary IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by cross-sight scripting and path traversal vulnerabilities. Vulnerability Details CVEID:CVE-2026-11712 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 is affected by a...
Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by affected by multiple vulnerabilities (CVE-2026-50645, CVE-2026-9322, CVE-2026-9171)
Summary IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by uncontrolled resource consumption and denial of service. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a...
Security Bulletin: A Use After Free vulnerability may affect TXSeries for Multiplatforms (CVE-2025-38000).
Summary A Use After Free vulnerability may affect TXSeries for Multiplatforms CVE-2025-38000. To address the vulnerability, the base container image for TXSeries for Multiplatforms has been updated to Red Hat Enterprise Linux RHEL Universal Base Image UBI 9 Minimal. Vulnerability Details...
Security Bulletin: Security vulnerability has been found in WebSphere Application Server Liberty shipped with IBM License Metric Tool
Summary WebSphere Application Server Liberty is shipped as a component of IBM License Metric Tool. Information about a security vulnerability affecting WebSphere Application Server Liberty has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in t...
Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.
Summary Multiple vulnerabilities have been found in CICS Transaction Gateway for Multiplatforms due to the use of IBM WebSphere Application Server Liberty, IBM WebSphere Application Server and Jackson Databind. The versions of IBM WebSphere Application Server Liberty, IBM WebSphere Application...
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-0994 DESCRIPTION: A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when...
Security Bulletin: IBM Engineering Requirements Management DOORS Next is impacted by vulnerabilities in FasterXML jackson-databind
Summary Vulnerabilities have been identified in FasterXML jackson-databind, which is used in IBM Engineering Requirements Management DOORS Next. Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can...
Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-50645, CVE-2026-9322, CVE-2026-9171)
Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can le...
Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-9071, CVE-2026-9320, CVE-2026-8646)
Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-9071 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a...
Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2026-11541)
Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2026-11541 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an...
Security Bulletin: IBM watsonx.data integration (Data Observability) is affected by an execute code over a network due to azure_core vulnerability.
Summary IBM watsonx.data integration Data Observability is vulnerable to azurecore-1.30.2-py3-none-any.whl CVE-2026-21226. Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network. Vulnerability Details...
Security Bulletin: IBM watsonx.data integration (Data Observability) is affected by a denial-of-service (DoS) due to protobuf
Summary IBM watsonx.data integration Data Observability is vulnerable to protobuf-3.20.3-cp39-cp39-manylinux25x8664.manylinux1x8664.whl CVE-2026-0994. A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed...
Security Bulletin: terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
Summary The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498...
Security Bulletin: terraform-mcp-server vulnerable to server side request forgery leading to token exposure
Summary The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an...
Security Bulletin: terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user
Summary The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat [CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515]
Summary Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515. Apache tomcat is used in our speech microservices. These vulnerabilitie...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2025-14087...
Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-9071)
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix
Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 uses gix and gix-submodule crates that are vulnerable to command injection. Vulnerability Details CVEID:CVE-2026-40034 DESCRIPTION: gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0...
Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of the cargo crate
Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 ships a version of the cargo crate that incorrectly handles symlinks inside tar balls. Vulnerability Details CVEID:CVE-2026-5222 DESCRIPTION: Cargo between 1.68 and 1.96 incorrectly normalized the URLs of...
Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects TS3100/TS3200 (CVE-2015-4000)
Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects TS3100/TS3200. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a...
Security Bulletin: Vulnerability in SSLv3 affects IBM System Storage Tape Controller 3592 Model C07 (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM System Storage Tape Controller 3592 Model C07. Vulnerability Details CVE ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attack...
Security Bulletin: Security Vulnerability in the IBM Java Runtime Environment (JRE) affect the 3592 Enterprise Tape Controller
Summary Vulnerabilities in in the IBM Java Runtime Environment JRE , affect the 3592 Enterprise Tape Controller. These vulnerabilities were disclosed in the Java Critical Patch Updates for July and October 2015 Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An unspecified vulnerability a...
Security Bulletin: Unauthenticated User Could Gain Remote Access to TS3100/TS3200 (CVE-2016-9005)
Summary IBM TS3100/TS3200 Tape Library could allow an unauthenticated user, with access to the company network, to change a user's password and gain remote access to the system. Vulnerability Details CVEID:CVE-2016-9005 DESCRIPTION: IBM TS3100-TS3200 Tape Library could allow an unauthenticated...
Security Bulletin: Vulnerability in SSLv3 affects TS3100/TS3200 (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in TS3100/TS3200. Vulnerability Details CVE-ID : CVE-2014-3566 DESCRIPTION : Product could allow a remote attacker to obtain sensitive information...
Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of the openssl crate
Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 ships a version of the openssl crate that contains multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-42327 DESCRIPTION: rust-openssl provides OpenSSL bindings for the Rust programming language. Fr...
Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could allow unauthorized library access (CVE-2011-1372)
Abstract Administrative access to the library may be obtained without supplying proper credentials. Content Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could allow unauthorized library access CVE-2011-1372 SUMMARY: Administrative access to the library may be obtained...
Security Bulletin: Cargo in IBM Open SDK for Rust on AIX uses a vulnerable version of gix-fs
Summary The cargo package manager in IBM Open SDK for Rust on AIX 1.92.0.2 and 1.94.0.0 uses version 0.19 of the gix-fs crate which is vulnerable to improper link resolution before file access. Vulnerability Details CVEID:CVE-2026-44471 DESCRIPTION: gitoxide is an implementation of git written in...
Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues
Summary Multiple vulnerabilities affect IBM Sterling External Authentication Server and are addressed in the latest release and fixpack Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily exploitable vulnerability issue that...
Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues
Summary Multiple vulnerabilities affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of th...
Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues
Summary Multiple vulnerabilities CVE-2026-2332, CVE-2026-5795, CVE-2025-11143, CVE-2026-33227, CVE-2026-39304 affect IBM Sterling Secure Proxy and are addressed in the latest release and ifix. Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to...
Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues
Summary Multiple vulnerabilities affect IBM Sterling Secure Proxy and are addressed in the latest release and ifix. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle...
Security Bulletin: IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information (CVE-2026-14512, CVE-2026-14528 )
Summary IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information. Vulnerability Details CVEID:CVE-2026-14512 DESCRIPTION: IBM WebSphere Application Server traditional is vulnerable to pre-authentication unsafe deserialization which could allo...
Security Bulletin: IBM Maximo Application Suite uses postcss-8.4.49.tgz which is vulnerable to CVE-2026-41305.
Summary IBM Maximo Application Suite uses postcss-8.4.49.tgz which is vulnerable to CVE-2026-41305. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-41305 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and...
Security Bulletin: IBM Maximo Application Suite uses dompurify-3.3.2.tgz which is vulnerable to CVE-2026-41238, CVE-2026-41239, CVE-2026-41240.
Summary IBM Maximo Application Suite uses fdompurify-3.3.2.tgz which is vulnerable to CVE-2026-41238, CVE-2026-41239, CVE-2026-41240. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-41238 DESCRIPTION: DOMPurify is a DOM-only...
Security Bulletin: IBM Maximo Application Suite uses python_dotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684.
Summary IBM Maximo Application Suite uses pythondotenv-1.0.1-py3-none-any.whl which is vulnerable to CVE-2026-28684. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-28684 DESCRIPTION: python-dotenv reads key-value pairs from a...
Security Bulletin: IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)
Summary IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515. Vulnerability Details CVEID:CVE-2026-14974 DESCRIPTION: IBM WebSphere Application Server traditional could allow a remote attacker to execute arbitrary...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Cryptographic Algorithm vulnerability in Bouncy Castle [CVE-2026-5588]
Summary IBM Watson Speech Services Cartridge is vulnerable to a Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc, due to a flaw in BC-JAVA bcpkix on all pkix modules CVE-2026-5588. Bouncy Castle is used in our speech microservices. This vulnerabili...
Security Bulletin: IBM Rhapsody Systems Engineering is vulnerable to prototype pollution abuse
Summary A security vulnerability was identified in the axios package used in IBM Rhapsody Systems Engineering. The issue has been resolved and patched. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and...
Security Bulletin: IBM WebSphere Application Server is affected by a privilege escalation (CVE-2026-14446)
Summary IBM WebSphere Application Server is affected by a privilege escalation vulnerability. Vulnerability Details CVEID:CVE-2026-14446 DESCRIPTION: IBM WebSphere Application Server is vulnerable to broken access control/privilege escalation in the administrative console. CWE:CWE-306: Missing...
Security Bulletin: IBM WebSphere Application Server is affected by an authentication bypass (CVE-2026-16184)
Summary IBM WebSphere Application Server is affected by an authentication bypass. Vulnerability Details CVEID:CVE-2026-16184 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. CWE:CWE-862: Missing...