Threat database

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a heap buffer overflow when processing MQPUT operations with malformed distribution headers.

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM Common Licensing versions 9.0, 9.0.0.1, 9.0.0.2, and corresponding ART versions are affected by a cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject arbitrary JavaScript into the web interface, potentially altering functionality and leading to credential disclosure within trusted sessions. The vulnerability has a medium severity rating with a CVSS score of 6.1.

IBM Common Licensing versions 9.0, 9.0.0.1, 9.0.0.2, and ART 9.0 series generate error messages that disclose sensitive information about their environment, users, or associated data. This information exposure vulnerability is identified as CWE-209. The issue has a medium severity with a CVSS score of 4.3. No specific affected versions are detailed, and no patch or remediation information is provided.

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM Common Licensing versions including Agent 9.0, 9.0.0.1, 9.0.0.2 and ART 9.0, 9.0.0.1, 9.0.0.2 contain a cross-site scripting (XSS) vulnerability. This flaw allows users to inject arbitrary JavaScript into the web interface, potentially altering functionality and leading to credential disclosure within a trusted session. The vulnerability is rated medium severity with a CVSS score of 6.1.

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.

IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.

IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 transmit sensitive information in clear text. This vulnerability could allow an attacker to intercept sensitive data using man-in-the-middle techniques. The CVSS score is 5.9, indicating a medium severity risk. No known exploits are reported in the wild. The vulnerability does not affect cloud services and no patch information is provided.

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system.

IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.4 could allow an unauthenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

CVE-2025-1350 is a vulnerability in IBM Controller versions 11.0.0 and 11.1.0 where detailed technical error messages containing sensitive information are exposed to remote attackers via the browser. This exposure could aid attackers in further compromising the system. The vulnerability has a medium severity with a CVSS score of 5.3.

IBM Cognos Analytics versions 12.0.4 and 12.1.0 contain a vulnerability due to failure to properly enable HTTP Strict Transport Security (HSTS). This weakness could allow a remote attacker to intercept sensitive information via man-in-the-middle techniques. The issue is classified under CWE-327 for use of a broken or risky cryptographic algorithm. The vulnerability has a medium severity with a CVSS score of 5.9.

CVE-2026-11728 is a high-severity vulnerability in IBM MQ affecting multiple versions including 9.1.0.0, 9.2.0.0, 9.3.0.0, 9.4.0.0, and 10.0.0.0. It involves a heap buffer overflow caused by an out-of-bounds write when the client receives messages from a malicious queue manager or via a man-in-the-middle attack. This flaw could allow a remote attacker to cause denial of service or potentially execute arbitrary code on the client.