Threat database

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper enforcement of storage limits.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection.

IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images.

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.

IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

IBM Guardium Data Protection 12.2 has a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to execute arbitrary code by bypassing pathname restrictions. This vulnerability has a high severity with a CVSS score of 7.2. No patch or remediation details are currently provided by the vendor. The vulnerability affects version 12.2 of the product.

IBM Guardium Data Protection version 12.2 contains an OS command injection vulnerability (CWE-78) that could allow a remote attacker to execute arbitrary operating system commands. The vulnerability has a high severity with a CVSS score of 8.1, impacting confidentiality, integrity, and availability. No patch or remediation information is provided, and no exploits are known in the wild at this time.

IBM Guardium Data Protection 12.2 contains a cross-site request forgery (CSRF) vulnerability (CVE-2026-84084) that could allow remote attackers to bypass security restrictions. This vulnerability has a high severity rating with a CVSS score of 8.8. No specific patch or remediation information is currently available.

IBM Guardium Data Protection 12.2 Collector appliance has a local privilege escalation vulnerability due to improper privilege management in the SUID-root nmap_wrapper binary. A local attacker with low privileges can exploit insufficient argument validation in this binary to execute commands as root, resulting in full compromise of the appliance. The vulnerability is identified as CVE-2026-84083 with a high severity score of 7.8.

IBM Guardium Data Protection 12.2 contains a critical SQL injection vulnerability (CVE-2026-84082) that allows remote attackers to execute arbitrary SQL commands. The flaw arises from improper neutralization of special elements in SQL queries. This vulnerability has a CVSS score of 9.8, indicating a severe impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

IBM Guardium Data Protection version 12.2 contains a vulnerability due to improper certificate validation (CWE-295). This flaw could allow a remote attacker to bypass security restrictions, potentially impacting confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 8.1. No patch or remediation details are currently provided by the vendor.

IBM Guardium Data Protection 12.2 has a critical vulnerability (CVE-2026-84078) involving missing authentication in the LoadBalancerServlet. This flaw allows unauthenticated users to perform privileged load-balancer operations, potentially impacting system integrity and availability. The vulnerability has a CVSS score of 9.9, indicating critical severity.

IBM Guardium Data Protection version 12.2 contains a cross-site request forgery (CSRF) vulnerability that could allow a remote attacker to bypass security restrictions. This vulnerability does not impact confidentiality but can lead to high integrity and availability impacts if exploited. The vulnerability has a high severity rating with a CVSS score of 8.1. No patch or remediation information is currently provided by the vendor.

IBM Guardium Data Protection version 12.2 contains a high severity vulnerability (CVE-2026-84076) involving improper authorization. This flaw allows a remote authenticated attacker to bypass security restrictions due to insufficient enforcement of access controls, potentially enabling unauthorized actions. The vulnerability has a CVSS score of 7.6, indicating significant impact on integrity and availability.