IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a vulnerability where an authenticated flow author can write attacker-controlled file content into any directory writable by the service account, bypassing local file access isolation. Additionally, an attacker can read arbitrary files accessible to the service process by using a crafted on-disk index, potentially exposing sensitive configuration files, secrets, or database files stored under the application's data directory.
IBM SevOne Network Performance Management versions 7.0.0 through 8.2.2 contain a vulnerability that allows a remote attacker to cause a denial of service by triggering uncontrolled resource consumption. This vulnerability does not impact confidentiality or integrity but results in service disruption.
IBM Security Verify Directory versions 10.0.0 through 10.0.4 and version 11.0.0 are affected by a session fixation vulnerability. This flaw allows an attacker to establish a session and then hijack the authenticated session after the victim logs in, potentially gaining unauthorized access to the directory management console.
IBM DataStage on Cloud Pak for Data version 5.4.0.0 contains an XML External Entity (XXE) injection vulnerability that could allow a remote authenticated attacker to access sensitive information. The vulnerability requires authentication and does not allow code execution or denial of service. It has a medium severity rating with a CVSS score of 5.0.
IBM Guardium Key Lifecycle Manager versions 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 contain a vulnerability due to the use of a weak cryptographic algorithm. This flaw could allow a local attacker to obtain sensitive information. The vulnerability has a medium severity rating with a CVSS score of 6.8.
IBM DataStage on Cloud Pak for Data version 5.4.0.0 contains a vulnerability that allows a remote authenticated attacker to delete arbitrary files via a path traversal flaw. This vulnerability requires authentication and can lead to integrity and availability impacts without affecting confidentiality.
IBM Sterling B2B Integrator versions 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 through 6.2.2.1_1, and IBM Sterling File Gateway versions 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 through 6.2.2.1_1 Standard Edition contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information due to improper logging of sensitive credentials.
IBM Guardium Data Protection version 12.2.4 contains a vulnerability that could allow a remote authenticated attacker to execute arbitrary commands. This is due to improper neutralization of argument delimiters, which may enable command injection. The vulnerability has a CVSS score of 6.7, indicating a medium severity level. No specific affected versions beyond 12.2.4 are stated, and no patch information is provided.
IBM Security Verify Directory versions 10.0.0 through 10.0.4 and 11.0.0 do not set the SameSite attribute on session cookies. This omission makes the application vulnerable to Cross-Site Request Forgery (CSRF) attacks, where an attacker could trick authenticated users into sending unauthorized requests. The vulnerability has a low severity score and does not impact confidentiality or availability.
IBM Guardium Data Protection version 12.2.4 contains a vulnerability where improper validation of CSRF tokens for GET requests could allow a remote attacker to bypass security restrictions. This flaw relates to Cross-Site Request Forgery (CSRF) protection mechanisms not being properly enforced on certain HTTP methods.
IBM Guardium Data Protection version 12.2.4 contains a vulnerability that could allow a remote attacker to execute arbitrary SQL commands. This is due to improper neutralization of special elements used in SQL commands, which is a classic SQL injection issue. The vulnerability has a medium severity rating with a CVSS score of 5.6.
IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a vulnerability in the Host-Based Printer Subsystem that allows a remote unauthenticated attacker to obtain sensitive information. This occurs due to the absence of an authorization check, enabling unauthorized printing of files. The vulnerability has a medium severity with a CVSS score of 4.8.
IBM Guardium Data Protection version 12.2.4 contains a vulnerability that could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. The vulnerability has a low severity score and requires low privileges to exploit. There is no indication of active exploitation in the wild or available patches at this time.
IBM Guardium Data Protection version 12.2.4 contains a vulnerability that could allow a remote authenticated attacker to obtain sensitive information by exploiting improper limitation of a pathname to a restricted directory. The vulnerability is classified as CWE-22 (Path Traversal).
IBM Content Navigator versions 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 contain an LDAP injection vulnerability. This flaw allows a remote authenticated attacker to send specially crafted requests that could enable enumeration of LDAP directory information. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 contain an information disclosure vulnerability. This flaw arises from unsafe class reflection in the JMX REST connector body parser, potentially allowing unauthorized information exposure. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data versions 4.8.4 through 4.8.5 and 5.0.0 through 5.4.2 contains a vulnerability where backend authorization checks are not enforced. This allows low-privileged users to bypass UI-level restrictions and directly invoke administrative API endpoints, potentially executing privileged functions without proper authorization.
IBM CockroachDB PostgreSQL for IBM VPC versions 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 contain a vulnerability that allows privilege escalation via user-defined functions. This vulnerability has a high severity score of 7.1 and impacts confidentiality and integrity without affecting availability. No patch or remediation information is provided in the available data.
IBM Concert versions 1.0 through 3.0.1.1 contain a command injection vulnerability where crafted input is incorporated into operating system commands without proper validation. This flaw allows remote attackers to execute arbitrary commands with the privileges of the affected service. The vulnerability is critical with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
IBM Cloud Pak for Data System versions 11.3.1.2 Interim Fix 001 through 11.3.1.2 Interim Fix 002 contain a vulnerability that allows users with administrative privileges to read and write arbitrary files due to incorrect permission assignments. This could lead to unauthorized data access and modification within the system.