Filtered by vendor Ibm
Subscriptions
Total
7292 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2024-35117 | 1 Ibm | 1 Openpages With Watson | 2024-12-11 | 4.4 Medium |
IBM OpenPages with Watson 9.0 may write sensitive information, under specific configurations, in clear text to the system tracing log files that could be obtained by a privileged user. | ||||
CVE-2023-37395 | 1 Ibm | 1 Aspera Faspex | 2024-12-11 | 2.5 Low |
IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data. | ||||
CVE-2023-23472 | 1 Ibm | 1 Infosphere Information Server | 2024-12-11 | 3.1 Low |
IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7) could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system. | ||||
CVE-2024-51460 | 1 Ibm | 1 Infosphere Information Server | 2024-12-11 | 4.3 Medium |
IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. | ||||
CVE-2021-29892 | 1 Ibm | 1 Cognos Controller | 2024-12-11 | 5.9 Medium |
IBM Cognos Controller 11.0.0 and 11.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. | ||||
CVE-2024-25019 | 1 Ibm | 1 Cognos Controller | 2024-12-11 | 5.5 Medium |
IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the type of file uploaded to Journal entry attachments. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attacks. | ||||
CVE-2024-25035 | 1 Ibm | 1 Cognos Controller | 2024-12-11 | 5.3 Medium |
IBM Cognos Controller 11.0.0 and 11.0.1 exposes server details that could allow an attacker to obtain information of the application environment to conduct further attacks. | ||||
CVE-2024-25036 | 1 Ibm | 1 Cognos Controller | 2024-12-11 | 4.3 Medium |
IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user with local access to bypass security allowing users to circumvent restrictions imposed on input fields. | ||||
CVE-2024-40691 | 1 Ibm | 1 Cognos Controller | 2024-12-11 | 8 High |
IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks. | ||||
CVE-2024-25020 | 1 Ibm | 1 Cognos Controller | 2024-12-11 | 5.5 Medium |
IBM Cognos Controller 11.0.0 and 11.0.1 is vulnerable to malicious file upload by allowing unrestricted filetype attachments in the Journal entry page. Attackers can make use of this weakness and upload malicious executable files into the system and can be sent to victims for performing further attacks. | ||||
CVE-2024-41775 | 1 Ibm | 1 Cognos Controller | 2024-12-11 | 5.9 Medium |
IBM Cognos Controller 11.0.0 and 11.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | ||||
CVE-2024-41776 | 1 Ibm | 1 Cognos Controller | 2024-12-11 | 6.5 Medium |
IBM Cognos Controller 11.0.0 and 11.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | ||||
CVE-2024-41777 | 1 Ibm | 1 Cognos Controller | 2024-12-11 | 7.5 High |
IBM Cognos Controller 11.0.0 and 11.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. | ||||
CVE-2024-45676 | 1 Ibm | 1 Cognos Controller | 2024-12-11 | 4.3 Medium |
IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user to upload insecure files, due to insufficient file type distinction. | ||||
CVE-2023-50955 | 1 Ibm | 1 Infosphere Information Server | 2024-12-10 | 2.4 Low |
IBM InfoSphere Information Server 11.7 could allow an authenticated privileged user to obtain the absolute path of the web server installation which could aid in further attacks against the system. IBM X-Force ID: 275777. | ||||
CVE-2023-50303 | 1 Ibm | 1 Infosphere Information Server | 2024-12-10 | 6.1 Medium |
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 273333. | ||||
CVE-2023-33843 | 1 Ibm | 1 Infosphere Information Server | 2024-12-10 | 5.4 Medium |
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 256544. | ||||
CVE-2024-47115 | 1 Ibm | 2 Aix, Vios | 2024-12-10 | 7.8 High |
IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input. | ||||
CVE-2024-47117 | 1 Ibm | 1 Carbon Charts | 2024-12-10 | 5.4 Medium |
IBM Carbon Design System (Carbon Charts 0.4.0 through 1.13.16) is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
CVE-2024-37071 | 1 Ibm | 1 Db2 | 2024-12-09 | 5.3 Medium |
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user to cause a denial of service with a specially crafted query due to improper memory allocation. |