CVE Vulnerability Catalog

IBM Business Automation Workflow (containers and traditional) lacks authorization controls, allowing an authenticated attacker to trigger restricted import actions. The flaw stems from insufficient enforcement of permissions on import operations.

IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain a deserialization of untrusted data vulnerability. An authenticated attacker could exploit it to execute arbitrary code.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to improper handling of XML external entities during RFH2 folder parsing. An authenticated attacker could read files from a vulnerable .NET client or cause a limited denial of service.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 (Classes for Java) contain an XML External Entity Injection vulnerability in MQRFH2 header processing. An authenticated attacker could obtain sensitive information or cause a denial of service.

IBM Verify Identity Access contains a vulnerability due to insufficient validation of incoming request resources. A remote attacker could cause a denial of service.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to insufficient input validation, enabling JNDI injection attacks. This could lead to information disclosure or remote code execution.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to improper validation of JNDI names in the Resource Adapter Installation Verification Test application. An authenticated attacker could execute arbitrary code on the application server.

IBM MQ versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to improper validation of deeply nested certificate data during TLS certificate processing. A remote attacker with a trusted TLS client certificate could cause a denial of service and potentially affect memory contents.

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.

IBM Verify Identity Access contains a vulnerability due to improper validation of user-supplied input. An administrator could execute additional commands they are not entitled to.

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user-supplied data.

IBM Verify Identity Access is vulnerable to a buffer overflow attack.

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services.

IBM Verify Identity Access contains a vulnerability due to insufficient validation of incoming request resources. A remote attacker could cause a denial of service.

IBM Verify Identity Access containers may not apply management password change operations correctly.

IBM ContextForge MCP Gateway <= v1.0.4 allows an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content. The flaw enables evasion of security controls through content hidden in nested structures.

IBM Cloud Pak for Business Automation versions 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to XPath injection. An authenticated attacker could exfiltrate sensitive application data and/or determine the structure of the XML document.

IBM MQ versions 9.1, 9.2, 9.3, 9.4, and 10.0 contain a vulnerability due to unsafe deserialization that enables JNDI injection attacks. An authenticated attacker could execute arbitrary code in client applications.

A heap buffer overflow vulnerability in IBM MQ occurs when receiving messages from a malicious queue manager or through a man-in-the-middle attack. It affects multiple LTS and CD versions, including 9.1, 9.2, 9.3, 9.4, and 10.0.0.0. It could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client.