CVE-2016-6089

CVE-2016-6089 affects IBM WebSphere MQ versions 9.0.0.1 and 9.0.2. The vulnerability arises from improper access controls, enabling a local user to write to or delete files in a directory they should not access. This is a local-privilege-impact issue; no exploit details are provided in the source...

CVE-2020-4682

CVE-2020-4682 : IBM MQ could allow remote code execution due to unsafe deserialization of trusted data. Affected MQ versions include 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD; root cause is unsafe deserialization. Impact is remote arbitrary code execution. Remediation is to apply the fixed releases...

CVE-2010-2638

IBM WebSphere MQ 7.0 up to 7.0.1.5 is affected by a vulnerability that lets remote authenticated users cause a denial-of-service (disk consumption) by triggering an FDC with RM680004 Probe Id. No exploit details are provided in the sources; CVSS info indicates a low–medium impact (base score 4.0)...

CVE-2009-0896

CVE-2009-0896 affects IBM WebSphere MQ 6.x (pre-6.0.2.7) and 7.x (pre-7.0.1.0). The queue manager has a buffer overflow in processing requests, allowing a remote attacker to execute arbitrary code. Exploitation described as remote and unauthenticated in affected versions. Remediation (where docum...

CVE-2018-1543

CVE-2018-1543 affects IBM WebSphere MQ: information disclosure via improper SSL certificate validation. A remote attacker could obtain sensitive data through man-in-the-middle techniques. Affected versions (per sources in connected docs): MQ server 8.0.0.x from 8.0.0.0 to 8.0.0.9, and MQ 9.0.0.x ...

CVE-2018-1974

CVE-2018-1974 affects IBM MQ (WebSphere MQ) 8.x and 9.x. The issue allows an authenticated attacker to escalate privileges when using multiplexed channels, due to how channels are multiplexed. Affected products/versions include IBM MQ v8 (8.0.0.0–8.0.0.10), MQ v9 LTS (9.0.0.0–9.0.0.5), MQ v9.1 CD...

CVE-2018-1503

CVE-2018-1503 affects IBM WebSphere MQ (IBM MQ) versions: 7.5.0.0–7.5.0.8, 8.0.0.0–8.0.0.9, and 9.0.0.0–9.0.0.3. A remotely authenticated attacker could send invalid or malformed headers that block message transmission on the affected channels, effectively a denial of service. The IBM bulletin pr...

CVE-2018-1551

CVE-2018-1551 affects IBM WebSphere MQ 8.0.0.2–8.0.0.8 and 9.0.0.0–9.0.0.3. The issue allows a user to obtain more authority than intended if an MQ administrator creates an invalid user group name, due to improper handling of group names. Remediation: apply IBM fixes—8.0.0.9 or above for the 8.x ...

CVE-2018-1792

Summary: CVE-2018-1792 affects IBM WebSphere MQ and IBM MQ across multiple 8.x/9.x releases, enabling a local user to inject code that could run with root privileges due to an incomplete fix. Affected ranges include 8.0.0.0–8.0.0.10, 9.0.0.0–9.0.0.5, 9.0.1–9.0.5, and 9.1.0.0. Impact (as stated): ...

CVE-2009-3160

CVE-2009-3160 affects IBM WebSphere MQ 6.x up to 6.0.2.7 and 7.0.x (7.0.0.0, 7.0.0.1, 7.0.0.2, 7.0.1.0). The issue is related to a memory overwrite vulnerability when read-ahead or asynchronous message consumption is enabled. The provided documents describe an unspecified impact and unknown vecto...

CVE-2018-1388

CVE-2018-1388 is a GSKit V7 vulnerability that can disclose side-channel information through discrepancies in PKCS#1 padding. It has been addressed in multiple IBM advisories across products using GSKit, including IBM i, WebSphere-related offerings, IBM Tivoli Directory Server, IBM Security Direc...

CVE-2019-4261

CVE-2019-4261 affects IBM WebSphere MQ components across multiple MQ product lines (V7.1, V7.5, V8, V9.0 LTS, V9.1 LTS, and V9.1 CD). The issue is described as a denial-of-service vulnerability triggered by specially crafted messages, leading to partial availability impact. Sources consistently c...

CVE-2017-1337

CVE-2017-1337 affects IBM MQ (formerly WebSphere MQ) Java/JMS: IBM MQ V9.0.1 and 9.0.2 (and V9 CD) can transmit credentials in plaintext when PASSWORDPROTECTION=ALWAYS in mqclient.ini. Affected platforms include IBM MQ V8 (8.0.0.0–8.0.0.6) and V9 (9.0.0.0–9.0.0.1) with the issue documented for th...

CVE-2019-4619

CVE-2019-4619 is an information-disclosure issue in IBM MQ and IBM MQ Appliance where a local attacker can obtain sensitive data through trace logging. Affected products/versions include IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD. Root cause: sensitive data can be inc...

CVE-2012-4863

IBM WebSphere MQ 7.1 and 7.5 queue managers are vulnerable to a DoS via a buffer overflow when large messages are enqueued, per CVE-2012-4863. Affected: WebSphere MQ 7.1 without Fix Pack 7.1.0.2 and 7.5 without Fix Pack 7.5.0.1. Remediation: upgrade to Fix Pack 7.1.0.2 or 7.5.0.1 (or later). Expl...

CVE-2014-4771

CVE-2014-4771 affects IBM WebSphere MQ: remote authenticated users can exhaust queue slots via a crafted PCF query, impacting MQ servers in versions 7.0.1 before 7.0.1.13, 7.1 before 7.1.0.6, 7.5 before 7.5.0.5, and 8 before 8.0.0.1. The connected documents confirm the affected versions and the D...

CVE-2015-0176

CVE-2015-0176 describes a reflected cross-site scripting (XSS) vulnerability in the IBM WebSphere MQ XR WebSockets Listener. According to IBM and NVD sources, the issue arises from improper validation/sanitation of user-supplied input in the URI, which can be included in an error response and cau...

CVE-2016-8915

CVE-2016-8915 affects IBM WebSphere MQ. The IBM security bulletin describes that an authenticated user with access to the queue manager and queue could cause denial of service to other channels running under the same MCA process. Affected products/versions include IBM WebSphere MQ on HP-UX (V8.0....

CVE-2017-1786

CVE-2017-1786 describes a memory-leak vulnerability in IBM MQ (WebSphere MQ) that under certain conditions could allow an authenticated user to exhaust resources and cause service loss. Affected products and versions include IBM MQ v8 (maintenance 8.0.0.0–8.0.0.8) and IBM MQ v9 LT S (9.0.0.0–9.0....

CVE-2016-9009

IBM WebSphere MQ CVE-2016-9009 allows an authenticated user with authority to create a cluster object to cause a denial of service in an MQ cluster. IBM’s bulletin describes that a cluster receiver channel definition could be altered, leading to corruption of cluster repository information and po...

CVE-2017-1341

CVE-2017-1341 in IBM WebSphere MQ affects MQ 8.x and 9.x (including MQ Appliance) where, under certain conditions, an unauthorized user could access an object that should be denied. The root cause is the MQOPEN operation succeeding when it should fail due to generic profile authority matching for...

CVE-2016-8971

IBM WebSphere MQ 8.0 is affected by CVE-2016-8971. An authenticated user with queue manager permissions could run management commands that access invalid memory, causing a segmentation fault and making the queue manager unresponsive until a reboot. The IBM security bulletin confirms the vulnerabi...

CVE-2017-1236

Summary of CVE-2017-1236 (IBM WebSphere MQ) is a denial-of-service vulnerability caused by saving an incorrect channel status inquiry. The IBM bulletin lists affected products/versions: IBM MQ 9.0.2 CD, IBM MQ Appliance 9.0.x CD, IBM MQ 9.0 LTS, IBM MQ 8.0, and IBM MQ Appliance 8.0. The impact is...

CVE-2012-2201

CVE-2012-2201 affects IBM WebSphere MQ 7.1. The DoS arises from an error when handling user IDs, enabling a remote attacker to bypass security configuration on a SVRCONN channel and flood the queue manager. Connected sources confirm the vulnerability in WebSphere MQ 7.1 and describe denial-of-ser...

CVE-2013-4054

CVE-2013-4054 describes a directory traversal in IBM WebSphere MQ 7.5 prior to 7.5.0.3, specifically in the MQ Telemetry component. The vulnerability arises from failure to properly filter user-submitted URL requests, allowing a remote attacker to read arbitrary files accessible to the mqm user v...

CVE-2016-3013

CVE-2016-3013 affects IBM WebSphere MQ 8.0 and earlier fixpacks; authenticated users can crash an MQ channel due to improper data conversion handling. IBM Security Bulletin entries describe affected versions (e.g., 8.0.0.5 and earlier), and remediation requires applying later maintenance levels: ...

CVE-2017-1285

CVE-2017-1285 affects IBM MQ (WebSphere MQ) versions 9.0.1–9.0.2 and related CD/appliance lines. An authenticated user with authority to send a specially crafted message could cause a SDR/CLUSSDR channel to remain running but stop processing messages, potentially impacting availability. Remediati...

CVE-2010-2637

CVE-2010-2637 affects IBM WebSphere MQ 6.0 before 6.0.2.9 and 7.0 before 7.0.1.1. The issue is that usernames and passwords are sent unencrypted in the security parameters field, allowing remote attackers to obtain sensitive information by sniffing traffic from a .NET client. The vulnerability is...

CVE-2016-0260

CVE-2016-0260 affects IBM WebSphere MQ 8.0.0.0 through 8.0.0.4. A memory leak in queue-manager agents on the error path can cause denial of service via heap exhaustion when many errors are triggered by a remote attacker. The issue’s root cause is a heap storage leak that is not deallocated during...

CVE-2018-1684

CVE-2018-1684 affects IBM WebSphere MQ 8.0 through 9.1. A vulnerability in MQTT topic string publishing could allow a denial-of-service against MQTT clients/queue manager. Affected IBM MQ releases include V8 (8.0.0.0–8.0.0.10), V9 LTS (9.0.0.0–9.0.0.5), V9 CD (9.0.1–9.0.5), and V9.1 LTS (9.1.0.0)...

CVE-2012-3294

The CVE-2012-3294 entry affects IBM WebSphere MQ File Transfer Edition (Web Gateway) and WebSphere MQ - Managed File Transfer. The IBM Security Bulletin confirms CSRF vulnerabilities in the Web Gateway that could allow an authenticated user to perform actions (add user accounts, modify permission...

CVE-2016-0379

CVE-2016-0379 – IBM WebSphere MQ DoS . An authenticated user with queue-manager rights can cause channel outages due to incorrect handling of MQ protocol flows. Affected: IBM WebSphere MQ 7.5 (7.5.0.0–7.5.0.6) and 8.0 (8.0.0.0–8.0.0.4). Remediation: upgrade to 7.5.0.7 or 8.0.0.5 or later maintena...

CVE-2017-1117

CVE-2017-1117 affects IBM WebSphere MQ (formerly WebSphere MQ) 8.0 and 9.0. An authenticated user can cause a denial of service on the MQXR channel when trace is enabled. Public docs (IBM bulletin) list affected versions and fixed levels: WebSphere MQ 7.5.0.0–7.5.0.7 are fixed by 7.5.0.8; MQ 8.0....

CVE-2017-1433

CVE-2017-1433 affects IBM WebSphere MQ 7.5 (7.5.0.0–7.5.0.8), 8.0 (8.0.0.0–8.0.0.7), and 9.x (9.0.0.0–9.0.0.1) where an authenticated user can insert messages with a corrupt RFH header into a channel, causing the channel process to restart and potentially impact availability. The issue is due to ...

CVE-2017-1612

CVE-2017-1612 affects IBM WebSphere MQ: the service trace module in MQ 7.0.x–9.0.x could be used to execute untrusted code as the mqm user via an undocumented environment variable. Affected versions include 7.0.1.0–7.0.1.14, 7.1.0.0–7.1.0.8, 7.5.0.0–7.5.0.8, 8.0.0.0–8.0.0.7, 9.0.0.0–9.0.0.1, and ...

CVE-2019-4039

CVE-2019-4039 affects IBM WebSphere MQ: 8.0.0.0–8.0.0.9 and 9.0.0.0–9.1.1. The issue allows a local attacker to cause a denial of service within the error log reporting system. Root cause is tied to the error logging function; no exploit details are provided in the documents. The vulnerability is...

CVE-2019-4078

CVE-2019-4078 affects IBM WebSphere MQ installations on Windows where incorrect permissions on MQ installation directories permit a local non-privileged user to execute code with administrator privileges. Affected MQ versions include 8.0.0.0–8.0.0.9 and 9.0.0.0–9.1.1. IBM remediation/fixes are av...

CVE-2016-3052

IBM WebSphere MQ can reveal passwords in cleartext over the network under nonstandard configurations, enabling MITM exposure. The IBM bulletin references CVE-2016-3052 among vulnerable MQ components and provides remediation via QRadar MQJMS protocol fixes (e.g., 7.3.0-QRADAR-PROTOCOL-MQJMS-7.3-20...

CVE-2017-1235

IBM WebSphere MQ is affected by CVE-2017-1235. The IBM security bulletin states that termination during an MQGET call of a client application running on a channel with SHARECNV=1 could cause a SIGSEGV and termination of the channel agent process, potentially leading to a denial of service. Affect...

CVE-2017-1283

IBM WebSphere MQ 8.0 and 9.0 is affected by CVE-2017-1283 due to a shared memory leak caused by MQ applications using dynamic queues. An authenticated user can trigger the leak, potentially exhausting resources for other MQ applications. Affected versions include IBM MQ 8.0.0.0–8.0.0.6 and 9.0.0....

CVE-2017-1284

IBM MQ (WebSphere MQ) versions affected: 8.x up to 8.0.0.6; 9.0.0.0–9.0.0.1; and 9.0.1–9.0.2 (CD). A local user able to enable/trace may obtain sensitive data from WebSphere Application Server traces, including credentials, via CLIENT transport mode traces. Root cause: traces disclose credentials...

CVE-2020-4310

Summary of CVE-2020-4310 details from provided documents: IBM MQ and MQ Appliance are vulnerable to a denial-of-service condition due to an error in the Data Conversion logic. The vulnerability affects multiple versions, including IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C...

CVE-2016-8986

CVE-2016-8986 affects IBM WebSphere MQ, allowing an authenticated user with access to the queue manager to bring down MQ channels via specially crafted HTTP requests. The vulnerability is documented with CVSS v3.0 base score 6.5 (vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and CVSS v2.0...

CVE-2017-1760

IBM WebSphere MQ (IBM MQ) versions 7.5, 8.0, and 9.0 could allow a local user to crash the queue manager agent thread and expose sensitive information. Affected products/versions include MQ 7.5.0.0–7.5.0.8, MQ 8.0.0.0–8.0.0.6, MQ 9.0.0.0–9.0.0.1, MQ 9 CD (9.0.1–9.0.3), and MQ Appliance variants. ...

CVE-2017-1747

CVE-2017-1747 affects IBM WebSphere MQ (IBM MQ) 9 LTS (maintenance 9.0.0.0–9.0.0.2) and 9 CD (maintenance 9.0.0–9.0.4). A specially crafted message could cause a denial of service in IBM MQ applications that process data conversion. The root cause is exposed in IBM’s Security Bulletin: a crafted ...

CVE-2019-4141

CVE-2019-4141 affects IBM WebSphere MQ and IBM MQ appliances. A memory leak in the clustering code leads to a denial-of-service condition. Affected versions include: WebSphere MQ 7.1.0.0–7.1.0.9, MQ 7.5.0.0–7.5.0.9, MQ 8.0.0.0–8.0.0.11, MQ 9.0.0.0–9.0.0.6, MQ 9.1.0.0–9.1.0.2, and MQ 9.1.1–9.1.2. ...

CVE-2021-38949

CVE-2021-38949 affects IBM MQ (and related IBM MQ components) across multiple versions (7.5, 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS). The root cause is that credentials are stored in plain clear text in the product, which could be read by a local user. The IBM IBM MQ Java/JMS/diagnostic environments can e...

CVE-2017-1557

CVE-2017-1557 affects IBM WebSphere MQ 8.0.0.0–8.0.0.7 and 9.0.0.0–9.0.0.1/9.0.1 CD–9.0.3 CD. An authenticated user with authority can send a specially crafted request that causes a channel process to cease processing further requests, effectively causing a denial of service. The IBM security bul...

CVE-2019-4656

The CVE-2019-4656 entry is a valid vulnerability in IBM MQ and IBM MQ Appliance (7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, 9.1 CD) where an authenticated user can craft a malicious message that causes a queue to be damaged and require a restart. The risk is a DoS affecting MQ queue processing. Remediation...

CVE-2019-4719

CVE-2019-4719 : IBM MQ and IBM MQ Appliance could allow a local attacker to obtain sensitive information via inclusion of sensitive data within runmqras data. The issue affects IBM MQ/Appliance across multiple versions (e.g., 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, 9.1 CD; Appliance 8.0, 9.1 LTS, 9.1 CD...