Ibm CVEs — known vulnerabilities

Security Privileged Identity Manager HIGH 8.8

CVE-2018-1622

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute…

Mitigation only

Fix from $1,950 2019-04-02

Security Privileged Identity Manager HIGH 8.8

CVE-2018-1640

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute arbitrary commands on the sys…

Mitigation only

Fix from $1,950 2019-04-02

Security Privileged Identity Manager HIGH 7.5

CVE-2018-1618

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote attacker to traverse directories on the system. An attacker cou…

Mitigation only

Fix from $1,950 2019-04-02

Security Privileged Identity Manager HIGH 7.5

CVE-2018-1680

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which makes it …

Mitigation only

Fix from $1,950 2019-04-02

Infosphere Information Server MEDIUM 6.5

CVE-2018-1906

IBM InfoSphere Information Server 11.3, 11.5, and 11.7could allow an authenticated user to download code using a specially crafted HTTP request. IBM …

Mitigation only

Fix from $1,600 2019-04-02

Infosphere Information Server MEDIUM 6.5

CVE-2018-1917

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an authenticated user to access JSP files and disclose sensitive information. IBM …

Mitigation only

Fix from $1,600 2019-04-02

Websphere Application Server HIGH 7.5

CVE-2019-4046

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers. A remot…

Fix: 19.0.0.4+

Fix from $1,950 2019-03-25

Api Connect HIGH 7.5

CVE-2019-4052

IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 15654…

Fix: after 2018.4.1.2

Fix from $1,950 2019-03-22

Content Navigator MEDIUM 5.4

CVE-2019-4035

IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, the…

Mitigation only

Fix from $1,600 2019-03-22

Db2 HIGH 7.8

CVE-2019-4094

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path pot…

Patch available

Fix from $1,950 2019-03-21

Power System S922 $9009 22a$ Firmware MEDIUM 6.4

CVE-2018-1992

The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that dri…

Mitigation only

Fix from $1,600 2019-03-21

Mq MEDIUM 5.4

CVE-2018-1836

IBM WebSphere MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.1.0.0, and 9.1.0.1 console is vulnerable to cross-site scripting. This vulnerability allows users to e…

Fix: after 9.1.0.1

Fix from $1,600 2019-03-21

Infosphere Streams MEDIUM 5.9

CVE-2017-1713

IBM InfoSphere Streams 4.2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.…

Patch available

Fix from $1,600 2019-03-21

Content Navigator HIGH 8.8

CVE-2019-4034

IBM Content Navigator 3.0CD is could allow an attacker to execute arbitrary code on a user's workstation. When editing an executable file in ICN with…

Mitigation only

Fix from $1,950 2019-03-14

Rational Collaborative Lifecycle Management MEDIUM 5.4

CVE-2018-1952

IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows u…

Fix: after 6.0.6