IBM i vulnerabilities

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a path traversal vulnerability that could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a vulnerability due to improper validation of an attacker-controlled file path, which could allow a local authenticated attacker to change the ownership of arbitrary files.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a TOCTOU race condition vulnerability that could allow a local authenticated attacker to obtain unauthorized access to files.

IBM i 7.6 contains an out-of-bounds write vulnerability that could allow a remote attacker to cause a denial of service.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap buffer overflow.

IBM i versions 7.6, 7.5, 7.4, and 7.3 use uninitialized memory during ASN.1 length processing, which could allow a remote attacker to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an improper authentication vulnerability during NTLM session negotiation, which could allow a remote attacker to access server resources with the privileges of an authenticated user.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a stack-based buffer overflow vulnerability that could allow a remote attacker to cause a denial of service and potentially obtain sensitive information.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an improper privilege management vulnerability that could allow a remote authenticated attacker to obtain unauthorized privileges.

IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an untrusted search path vulnerability that could allow a remote authenticated attacker to execute arbitrary code.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive information due to an integer underflow.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log files due to improper output neutralization for logs.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.

IBM i versions 7.6, 7.5, 7.4, and 7.3 are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name.

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to a race condition.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements in an SQL parameter.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking.

IBM i versions 7.6 and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

IBM i versions 7.6 and 7.5 contain a vulnerability that could allow a local attacker to gain elevated privileges due to improper neutralization of special elements used in OS commands.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i.

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart parser.