CVE Vulnerability Catalog

IBM MQ improperly validates cluster command message lengths. An authenticated attacker with cluster access could cause a denial of service or potentially execute arbitrary code.

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.

IBM MQ Java and JMS client libraries contain a deserialization filter bypass in exception handling. An authenticated attacker could execute arbitrary code on client applications.

IBM MQ Appliance has a heap buffer overflow in protocol message processing before authentication, allowing a remote attacker to cause DoS or potentially execute arbitrary code.

IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 contain an integer overflow in MQINQ request validation. An authenticated attacker could cause a denial of service or potentially escalate privileges.

IBM MQ contains a heap buffer overflow when processing MQPUT operations with malformed distribution headers. An authenticated attacker could cause a denial of service or potentially escalate privileges.

IBM MQ Console contains improper authorization checks that allow authenticated non-administrative users to create and start queue managers.

IBM MQ contains a buffer overflow when processing malformed compressed data on channels configured with compression enabled. A remote attacker could cause a denial of service or execute arbitrary code.

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.

XWiki Rendering prior to 14.10.2 and 15.0 RC1 allows any user who can edit their profile or any document to execute arbitrary script macros, including Groovy and Python, leading to remote code execution. The rendering output is included as HTML macro content without further escaping, allowing closure of the HTML macro and injection of script macros with programming rights.

IBM Controller (versions 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1) transmits data in clear text, allowing an attacker to obtain sensitive information using man-in-the-middle techniques.

IBM Controller (versions 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1) could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms (versions 3.2.4.0 through 3.2.4.16) is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

IBM Cognos Analytics (versions 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2) stores sensitive information in source code, which could be used by an authenticated user in further attacks against the system.

IBM TS4300 versions 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

IBM Common Licensing Agent 9.0 and ART 9.0 (including subversions) are vulnerable to cross-site request forgery, allowing an attacker to execute malicious actions from a user that the website trusts.

IBM Cloud Pak for Data 5.1.2 contains improper validation of user-supplied input. An authenticated user could execute arbitrary commands with elevated privileges on the system.

IBM Cloud Pak for Data 5.1.2 allows a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.