CVE Vulnerability Catalog

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

IBM App Connect Enterprise and IBM Integration Bus for z/OS write credentials in cleartext to trace logs. A local attacker could access this sensitive information.

IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to uncontrolled recursion, which could lead to denial of service. A local attacker could exploit this.

IBM i versions 7.6, 7.5, 7.4, and 7.3 have predictable server seeds, allowing a remote authenticated attacker to bypass security restrictions.

IBM i versions 7.6, 7.5, 7.4, and 7.3 are prone to a NULL pointer dereference, allowing a remote authenticated attacker to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 have a stack-based buffer overflow vulnerability that a local attacker could exploit to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 are vulnerable to a stack-based buffer overflow, allowing a remote authenticated attacker to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 improperly validate the prefix length in ICMPv6 Router Advertisements, allowing a remote attacker to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 have a buffer overflow vulnerability that a remote attacker could exploit to cause a denial of service and compromise integrity.

IBM i versions 7.6, 7.5, 7.4, and 7.3 lack authentication for critical functions, allowing a remote attacker to cause a denial of service and affect data integrity.

IBM i versions 7.6, 7.5, and 7.4 have improper authorization, allowing a remote authenticated attacker to modify certain system messages.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to obfuscate encryption keys.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities.

IBM Langflow OSS versions 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

IBM Cloud Pak for Data System versions 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack.