CVE-2023-28513

CVE-2023-28513 affects IBM MQ and IBM MQ Appliance across multiple releases (IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, 9.3 CD and corresponding MQ Appliance versions). The issue is a denial-of-service vulnerability caused by an error in processing messages under certain configurations. P...

CVE-2023-45177

CVE-2023-45177 affects IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD. The issue is a denial-of-service caused by an error in the MQ clustering logic. Affected entries explicitly state the clustering logic as the root cause and that a DoS can occur via this flaw. Public details in connected...

CVE-2019-4227

CVE-2019-4227 affects IBM MQ AMQP Listeners across multiple releases (8.0.0.4–8.0.0.12; 9.0.0.0–9.0.0.6; 9.1.0.0–9.1.0.2; 9.1.0–9.1.2). The issue allows an unauthorized user to conduct a session fixation attack due to clients not being disconnected as they should. Public details confirm the root ...

CVE-2022-31772

CVE-2022-31772 affects IBM MQ channels (MQTT) on IBM MQ versions 8.0, 9.0 LTS, 9.1 CD/LTS, and 9.2 CD/LTS. Root cause described as a denial of service vulnerable path in channel/messaging processing; authenticated, authorized user can trigger DoS on MQTT channels. Remediation: apply APAR IT33206 ...

CVE-2022-42436

CVE-2022-42436 affects IBM MQ Managed File Transfer in IBM MQ versions 8.0.0, 9.0.0, 9.1.0, 9.2.0 and 9.3.0, where a local user could obtain sensitive information from diagnostic files due to information disclosure. The Red Hat/IBM bulletin confirms the vulnerable range and notes an available fix...

CVE-2024-25016

CVE-2024-25016 affects IBM MQ and IBM MQ Appliance versions 9.0–9.3 (LTS/CD) and related IBM products. The issue is an improper buffering logic that could allow a remote unauthenticated attacker to cause a denial of service. Affected products include IBM MQ/Appliance across IBM App Connect Enterp...

CVE-2022-22489

CVE-2022-22489 affects IBM MQ and IBM MQ Explorer components (versions 8.0, 9.0, 9.1, 9.2 LTS and 9.1/9.2 CD). The issue is an XML External Entity (XXE) injection that occurs while processing XML data, enabling a remote attacker to access sensitive information or exhaust memory resources. The IBM...

CVE-2024-31919

CVE-2024-31919 affects IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD in certain configurations. The vulnerability enables a denial-of-service caused by an error processing messages when an API Exit uses MQBUFMH. IBM X-Force assigns a base score of 5.9 (vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S...

CVE-2022-22321

IBM MQ Appliance CVE-2022-22321 affects the 9.2 CD and 9.2 LTS releases, where local-messaging user passwords are stored using a hash that provides insufficient protection. The vulnerability can lead to exposure of sensitive data via password hashes. IBM’s remediation guidance (in IBM MQ Applianc...

CVE-2020-4267

CVE-2020-4267 affects IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD. An authenticated user could cause a denial of service via a memory leak in the LDAP authentication path. Affected versions include IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD. Remediation is available: apply IBM fixes FP...

CVE-2021-39034

CVE-2021-39034 (IBM MQ 9.1 LTS) is a denial-of-service vulnerability caused by an issue in the channel process. Public sources (IBM X-Force 213964) cite a base score of 5.3 (CVSS v3.0: AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Affected product: IBM MQ 9.1 LTS. Remediation per IBM bulletin IT37896 ind...

CVE-2021-38986

The CVE-2021-38986 issue affects IBM MQ Appliance 9.2 CD and 9.2 LTS, where sessions are not invalidated after logout, allowing an authenticated user to impersonate another user. Root cause is insufficient session expiration. IBM/IBM X-Force assign a base CVSS around medium (5.6). Remediation: up...

CVE-2023-28950

CVE-2023-28950 affects IBM MQ 8.0, 9.0, 9.1, 9.2, and 9.3, allowing disclosure of sensitive user information from a trace file when tracing is enabled. The primary public references list IBM MQ-related advisories and remediation paths: IBM Security Bulletin for App Connect Enterprise/Integration ...

CVE-2019-4568

CVE-2019-4568 affects IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS. A clustering-code error could allow a remote attacker to cause a denial of service when receiving data on the channel. IBM’s bulletin lists affected versions as IBM MQ 9.0 LTS and IBM MQ/Appliance 8.0, with remediation to apply fi...

CVE-2024-31912

CVE-2024-31912 (IBM MQ privilege escalation) In the provided documents, IBM MQ 9.3 LTS and 9.3 CD are vulnerable to privilege escalation when an authenticated user is subject to certain configuration conditions due to incorrect privilege assignments. The impact is high (unauthorized elevation of ...

CVE-2019-4055

Summary: CVE-2019-4055 affects IBM MQ versions 8.0.0.0–8.0.0.10, 9.0.0.0–9.0.0.5, and 9.1.0.0–9.1.1, enabling a denial-of-service through the TLS key renegotiation function. The root cause is a weakness in TLS renegotiation handling. Impact (as described): DoS affecting MQ services. Remediation/F...

CVE-2020-4682

CVE-2020-4682 : IBM MQ could allow remote code execution due to unsafe deserialization of trusted data. Affected MQ versions include 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD; root cause is unsafe deserialization. Impact is remote arbitrary code execution. Remediation is to apply the fixed releases...

CVE-2024-35156

CVE-2024-35156 affects IBM MQ 9.3 LTS and 9.3 CD, enabling a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser, leaking data that could aid further attacks. The affected components are IBM MQ instances in the 9.3 LTS and 9.3 CD bran...

CVE-2023-28514

CVE-2023-28514 affects IBM MQ versions 8.0, 9.0 and 9.1 where a local user could obtain sensitive credential information due to tracing logic that may expose detailed error messages in stack traces. The IBM bulletin (APAR IT43079) documents a vulnerability in tracing that stores sensitive data in...

CVE-2019-4378

CVE-2019-4378 affects IBM MQ command server across multiple releases (7.5.0.0–7.5.0.9, 7.1.0.0–7.1.0.9, 8.0.0.0–8.0.0.12, 9.0.0.0–9.0.0.6, 9.1.0.0–9.1.0.2, 9.1.0–9.1.2). It enables a denial-of-service by an authenticated and authorized user via specially crafted PCF messages. No exploitation deta...

CVE-2024-52897

CVE-2024-52897 affects IBM MQ web console. The IBM security bulletins describe that an attacker could obtain sensitive information when a detailed technical error message is returned. Affected: IBM MQ Appliance 9.3 LTS/CD and 9.4 LTS/CD (web console). Remediation/fix: apply the cumulative securit...

CVE-2019-4619

CVE-2019-4619 is an information-disclosure issue in IBM MQ and IBM MQ Appliance where a local attacker can obtain sensitive data through trace logging. Affected products/versions include IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD. Root cause: sensitive data can be inc...

CVE-2024-25015

IBM MQ has a vulnerability CVE-2024-25015 affecting IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru where a remote attacker could cause a denial of service by sending HTTP requests that consume all available resources. The CVSS base score is 7.5 (NETWORK, NO privileges, no user interaction...

CVE-2025-0985

Summary (CVE-2025-0985): IBM MQ 9.3 LTS/9.3 CD and 9.4 LTS/9.4 CD may store potentially sensitive information in environment variables that could be obtained by a local user. The CVSSv3.1 base score is 6.5 (Medium), with impact on confidentiality only. No exploitation details are provided in the ...

CVE-2019-4261

CVE-2019-4261 affects IBM WebSphere MQ components across multiple MQ product lines (V7.1, V7.5, V8, V9.0 LTS, V9.1 LTS, and V9.1 CD). The issue is described as a denial-of-service vulnerability triggered by specially crafted messages, leading to partial availability impact. Sources consistently c...

CVE-2024-35116

CVE-2024-35116 affects IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD. Vulnerability: denial of service caused by an error applying configuration changes. Impact: potential DoS with high availability impact. Affected products/versions are IBM MQ; no exploitation details provided in the doc...

CVE-2024-35155

The CVE-2024-35155 entry affects IBM MQ Console versions 9.3 LTS and 9.3 CD. The issue is an information disclosure vulnerability where a detailed technical error message returned in the browser could reveal sensitive information, which an attacker could use to inform further attacks. The vulnera...

CVE-2018-1836

CVE-2018-1836 affects IBM MQ Console (IBM WebSphere MQ) for CD: 9.0.2–9.0.5 and LTS: 9.1.0.0–9.1.0.1. The IBM bulletin attributes the issue to inadequate input validation in a Web UI form, enabling cross-site scripting that could permit an attacker to inject arbitrary JavaScript and potentially d...

CVE-2019-4049

CVE-2019-4049 affects IBM MQ 9.1.x (9.1.0.0, 9.1.0.1, 9.1.1, 9.1.0.2). The issue allows a local attacker to cause a denial of service by filling the underlying filesystem disk space via the error logging service. Root cause is in the error logging functionality. Remediation: IBM advises upgrading...

CVE-2024-54175

CVE-2024-54175 affects IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD. The vulnerability stems from an improper check for unusual or exceptional conditions, enabling a local attacker to cause a denial of service. The documented CVSS v3.1 base score is 5.5 (LOCAL, LOW complexity, HIGH impact on avail...

CVE-2024-52898

CVE-2024-52898 affects IBM MQ web consoles (9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD). The flaw stems from generating detailed error messages that disclose sensitive information (CWE-209), allowing a local user to obtain sensitive data. IBM’s security bulletins list the vulnerability within the IBM MQ Co...

CVE-2020-4310

Summary of CVE-2020-4310 details from provided documents: IBM MQ and MQ Appliance are vulnerable to a denial-of-service condition due to an error in the Data Conversion logic. The vulnerability affects multiple versions, including IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C...

CVE-2024-52896

CVE-2024-52896 affects IBM MQ web console (IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD). A remote attacker could obtain sensitive information when a detailed technical error message is returned. The related IBM advisories (CVE-2024-52896) document this as a password/sensitive-data disclosure...

CVE-2019-4614

CVE-2019-4614 affects IBM MQ and IBM MQ Appliance where a SIGSEGV DoS can occur when a client connects to a Queue Manager and processes an invalid message. Public details from IBM bulletins specify affected versions include IBM MQ/IBM MQ Appliance 8.0, 9.0 LTS, and 9.1 LTS, with remediation via F...

CVE-2020-4870

CVE-2020-4870 affects IBM MQ 9.2 CD and 9.2 LTS (and related IBM MQ versions per linked bulletin) via an error in the queue manager/channel processing that can be exploited to cause a denial of service when handling connecting applications. The root cause is an issue in the channel/connection pro...

CVE-2021-38949

CVE-2021-38949 affects IBM MQ (and related IBM MQ components) across multiple versions (7.5, 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS). The root cause is that credentials are stored in plain clear text in the product, which could be read by a local user. The IBM IBM MQ Java/JMS/diagnostic environments can e...

CVE-2019-4719

CVE-2019-4719 : IBM MQ and IBM MQ Appliance could allow a local attacker to obtain sensitive information via inclusion of sensitive data within runmqras data. The issue affects IBM MQ/Appliance across multiple versions (e.g., 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, 9.1 CD; Appliance 8.0, 9.1 LTS, 9.1 CD...

CVE-2019-4656

The CVE-2019-4656 entry is a valid vulnerability in IBM MQ and IBM MQ Appliance (7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, 9.1 CD) where an authenticated user can craft a malicious message that causes a queue to be damaged and require a restart. The risk is a DoS affecting MQ queue processing. Remediation...

CVE-2021-38875

CVE-2021-38875 affects several IBM MQ products: IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD, allowing a denial-of-service due to an error in processing messages. Connected citations indicate IBM MQ Appliance and HPE NonStop variants also reference the issue. Impact is a DoS vulnerab...

CVE-2019-4655

CVE-2019-4655 affects IBM MQ (9.1.x: 9.1.0.0–9.1.3) and IBM MQ Appliance; vulnerability arises from an error in the Data Conversion routine that could allow an authenticated user to reset client connections, causing a denial of service. Impact is a DoS on channel handling by triggering failure da...

CVE-2020-4931

IBM MQ AMQP Channels in IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD are affected by a vulnerability that allows an authenticated user to trigger a denial-of-service by processing messages incorrectly. The issue is addressed under APAR IT34485, with fixes/updates available per product version: IBM MQ v8 (...

CVE-2018-1883

CVE-2018-1883 affects IBM MQ Console REST API in IBM MQ 9.0.2–9.0.5 and 9.1.0.0. The issue enables a denial-of-service condition preventing users from logging into the MQ Console REST API. The IBM bulletin indicates affected products and provides remediation: upgrade to IBM MQ V9.1.1 for the 9 CD...

CVE-2019-4762

CVE-2019-4762 affects IBM MQ 9.0 and 9.1, with a denial-of-service vulnerability caused by an error in the Channel processing function. The issue is documented across IBM MQ advisories and multiple sources, and affects IBM MQ Appliance as well. Remediation is available: upgrade IBM MQ 9.1 LTS to ...

CVE-2020-4338

CVE-2020-4338 affects IBM MQ Appliance (and references IBM MQ 9.1.4) where a local attacker could obtain sensitive information via sensitive data in runmqras data. The IBM bulletin for this CVE indicates an incomplete fix earlier, and remediation advises upgrading to version 9.1.5 (for IBM MQ App...

CVE-2020-4320

CVE-2020-4320 affects IBM MQ Appliance and IBM MQ AMQP Channels (versions 8.0, 9.0 LTS, 9.1 LTS, 9.1 CD) due to improper handling of SSLPEER certificate DN; could allow connections based on certificate name. IBM Bulletins detail fixes: IBM MQ Appliance v8 fixpack 8.0.0.15, v9.1 LTS fixpack 9.1.0....

CVE-2025-36100

CVE-2025-36100 affects IBM MQ LTS and CD client components where enabling trace stores a password in client configuration files that a local user can read. The IBM bulletin details affected MQ LTS versions (9.1.0.0–9.1.0.29, 9.2.0.0–9.2.0.36, 9.3.0.0–9.3.0.30, 9.4.0.0–9.4.0.12) and MQ CD (9.3.0.0...

CVE-2025-36128

IBM MQ (versions 9.1, 9.2, 9.3, 9.4 LTS and 9.3/9.4 CD) is vulnerable to a denial of service caused by improper timeout enforcement on individual read operations, enabling slowloris-type attacks. A remote attacker could exhaust server resources to disrupt service. The vulnerability affects the RE...

CVE-2026-1713

IBM MQ is affected by CVE-2026-1713, an authority vulnerability (CWE-305) that could allow users access to SYSTEM.AUTH.DATA.QUEUE. Affected versions include IBM MQ 9.1.0.0–9.1.0.33 LTS, 9.2.0.0–9.2.0.40 LTS, 9.3.0.0–9.3.0.36 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.17 LTS, and 9.4.0.0–9.4.4.1 CD. I...