Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-36026 State: PUBLISHED Published: 2025-06-28T00:49:54.932Z Last Updated: 2025-08-24T11:38:32.866Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: IBM Products: Datacap Problem Types: CWE-614 Description: IBM Datacap 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ww
in the cookie value by snooping the traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7238443
CVE ID: CVE-2025-36027 State: PUBLISHED Published: 2025-06-28T00:51:07.042Z Last Updated: 2025-08-24T11:39:15.170Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Datacap Problem Types: CWE-1021 Description: IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7238443
CVE ID: CVE-2025-36034 State: PUBLISHED Published: 2025-06-26T15:14:10.478Z Last Updated: 2025-08-26T14:51:14.232Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-319 Description: IBM InfoSphere DataStage Flow Designer in IBM InfoSphere Information Server 11.7 discloses sensitive user information in API requests in clear text that could be intercepted using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7237604
CVE ID: CVE-2025-36035 State: PUBLISHED Published: 2025-09-14T12:52:48.871Z Last Updated: 2025-09-15T15:59:00.889Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H) Vendors: IBM Products: PowerVM Hypervisor Problem Types: CWE-770 Description: IBM PowerVM Hypervisor FW950.00 through FW950.E0, FW1050.00 through FW1050.50, and FW1060.00 through FW1060.40 could allow a local privileged user to cause a denial of service by issuing a specially crafted IBM i hypervisor call that would disclose memory contents or consume excessive memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244813
CVE ID: CVE-2025-36037 State: PUBLISHED Published: 2025-09-22T15:17:10.663Z Last Updated: 2025-09-22T15:40:55.670Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: webMethods Integration Problem Types: CWE-918 Description: IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7245758
CVE ID: CVE-2025-36038 State: PUBLISHED Published: 2025-06-25T20:38:02.468Z Last Updated: 2025-08-26T14:51:51.996Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-502 Description: IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7237967
CVE ID: CVE-2025-36039 State: PUBLISHED Published: 2025-07-30T23:47:25.483Z Last Updated: 2025-07-31T17:55:40.360Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-602 Description: IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms, Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7241007
CVE ID: CVE-2025-36040 State: PUBLISHED Published: 2025-07-30T23:48:52.209Z Last Updated: 2025-07-31T17:55:19.229Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-613 Description: IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7241007
CVE ID: CVE-2025-36041 State: PUBLISHED Published: 2025-06-15T12:51:06.394Z Last Updated: 2025-08-24T11:52:26.288Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N) Vendors: IBM Products: MQ Operator Problem Types: CWE-295 Description: IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose sensitive information or allow the attacker to perform unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
low the attacker to perform unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7236608
CVE ID: CVE-2025-36042 State: PUBLISHED Published: 2025-08-22T14:55:01.862Z Last Updated: 2025-08-22T15:05:10.392Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: QRadar SIEM Problem Types: CWE-79 Description: IBM QRadar SIEM 7.5 through 7.5.0 Dashboard is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242869
CVE ID: CVE-2025-36047 State: PUBLISHED Published: 2025-08-14T15:38:11.020Z Last Updated: 2025-11-03T19:54:04.049Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: IBM Products: WebSphere Application Server Liberty Problem Types: CWE-770 Description: IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7242086
CVE ID: CVE-2025-36048 State: PUBLISHED Published: 2025-06-18T16:04:28.802Z Last Updated: 2025-08-24T11:48:18.694Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: webMethods Integration Server Problem Types: CWE-250 Description: IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due to execution with unnecessary privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7237144
CVE ID: CVE-2025-36049 State: PUBLISHED Published: 2025-06-18T16:06:18.983Z Last Updated: 2025-08-24T11:50:08.864Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: webMethods Integration Server Problem Types: CWE-611 Description: IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7237146
CVE ID: CVE-2025-36050 State: PUBLISHED Published: 2025-06-19T17:13:40.753Z Last Updated: 2025-08-26T14:52:33.272Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: QRadar SIEM Problem Types: CWE-532 Description: IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 stores potentially sensitive information in log files that could be read by a local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7237317
CVE ID: CVE-2025-36054 State: PUBLISHED Published: 2025-11-06T14:11:49.396Z Last Updated: 2025-11-06T14:32:53.254Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Business Automation Workflow containers, Business Automation Workflow traditional with Process Federation Server Problem Types: CWE-79 Description: IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to e
ugh 24.0.1 and 25.0.0 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250261
CVE ID: CVE-2025-36056 State: PUBLISHED Published: 2025-07-01T01:00:03.022Z Last Updated: 2025-08-24T11:34:14.462Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: System Storage Virtualization Engine TS7700 Problem Types: CWE-79 Description: IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7238555
CVE ID: CVE-2025-36057 State: PUBLISHED Published: 2025-07-21T18:10:32.157Z Last Updated: 2025-08-18T01:32:20.671Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: IBM Products: Cognos Analytics Mobile Problem Types: CWE-299 Description: IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 is vulnerable to authentication bypass by using the Local Authentication Framework library which is not needed as biometric authentication is not used in the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239635
CVE ID: CVE-2025-36062 State: PUBLISHED Published: 2025-07-21T18:09:18.846Z Last Updated: 2025-08-18T01:33:11.704Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cognos Analytics Mobile Problem Types: CWE-311 Description: IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could be vulnerable to information exposure due to the use of unencrypted network traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239635
CVE ID: CVE-2025-36064 State: PUBLISHED Published: 2025-09-22T18:25:38.219Z Last Updated: 2025-09-22T20:29:49.385Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Sterling Connect:Express for Microsoft Windows Problem Types: CWE-307 Description: IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7245761
CVE ID: CVE-2025-36071 State: PUBLISHED Published: 2025-07-29T18:27:40.227Z Last Updated: 2025-07-29T19:32:16.496Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: IBM Db2 Problem Types: CWE-772 Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query due to improper release of memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240955
CVE ID: CVE-2025-36072 State: PUBLISHED Published: 2025-11-20T22:09:42.477Z Last Updated: 2025-11-21T15:51:57.885Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: webMethods Integration Problem Types: CWE-502 Description: IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untrusted object graphs data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7252090
CVE ID: CVE-2025-36081 State: PUBLISHED Published: 2025-10-28T14:53:10.782Z Last Updated: 2025-10-28T15:23:20.773Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-117 Description: IBM Concert Software 1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249356
CVE ID: CVE-2025-36082 State: PUBLISHED Published: 2025-09-15T15:31:45.446Z Last Updated: 2025-09-15T15:52:49.614Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: OpenPages Problem Types: CWE-525 Description: IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244777
CVE ID: CVE-2025-36083 State: PUBLISHED Published: 2025-10-28T14:55:35.813Z Last Updated: 2025-10-28T15:20:05.847Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Concert Software Problem Types: CWE-244 Description: IBM Concert Software 1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of heap memory before release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249356
CVE ID: CVE-2025-36085 State: PUBLISHED Published: 2025-10-28T14:58:30.727Z Last Updated: 2025-10-28T15:19:13.749Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Concert Problem Types: CWE-918 Description: IBM Concert 1.0.0 through 2.0.0 Software is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249356
CVE ID: CVE-2025-36087 State: PUBLISHED Published: 2025-10-13T00:38:14.262Z Last Updated: 2025-10-15T13:46:30.081Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Access, Verify Identity Access Container Problem Types: CWE-798 Description: IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under certain configurations, contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Additional Analyst Notes: - CISA AD
tion, outbound communication to external components, or encryption of internal data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247753
CVE ID: CVE-2025-36088 State: PUBLISHED Published: 2025-08-15T19:19:58.803Z Last Updated: 2025-08-15T19:48:45.853Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Storage TS4500 Library Problem Types: CWE-79 Description: IBM TS4500 1.11.0.0-D00, 1.11.0.1-C00, 1.11.0.2-C00, and 1.10.00-F00 web GUI is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7
usted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242263
CVE ID: CVE-2025-36090 State: PUBLISHED Published: 2025-07-10T14:12:55.709Z Last Updated: 2025-08-24T11:18:59.093Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Analytics Content Hub Problem Types: CWE-209 Description: IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in reconnaissance to gather information for future attacks from a detailed technical error message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7234122
CVE ID: CVE-2025-36091 State: PUBLISHED Published: 2025-11-03T15:14:02.557Z Last Updated: 2025-11-03T15:37:32.628Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: IBM Products: Cloud Pak For Business Automation Problem Types: CWE-283 Description: IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249999
CVE ID: CVE-2025-36092 State: PUBLISHED Published: 2025-11-03T15:15:43.546Z Last Updated: 2025-11-03T15:35:59.011Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Cloud Pak For Business Automation Problem Types: CWE-1284 Description: IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation of input length. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249999
CVE ID: CVE-2025-36093 State: PUBLISHED Published: 2025-11-03T15:54:30.869Z Last Updated: 2025-11-03T16:25:26.455Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Cloud Pak For Business Automation Problem Types: CWE-602 Description: IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249999
CVE ID: CVE-2025-36096 State: PUBLISHED Published: 2025-11-13T22:01:22.072Z Last Updated: 2025-11-15T04:56:15.962Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: AIX, VIOS Problem Types: CWE-522 Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7251173
CVE ID: CVE-2025-36097 State: PUBLISHED Published: 2025-07-16T17:44:14.979Z Last Updated: 2025-08-18T01:34:17.799Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: WebSphere Application Server, WebSphere Application Server Liberty Problem Types: CWE-121 Description: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow. An attacker can send a specially crafted request that cause the server to consume excessive memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/no
memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239856
CVE ID: CVE-2025-36099 State: PUBLISHED Published: 2025-09-29T18:20:09.984Z Last Updated: 2025-09-29T18:38:52.375Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-770 Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A privileged user could exploit this vulnerability to cause the server to consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246549
CVE ID: CVE-2025-36100 State: PUBLISHED Published: 2025-09-07T00:37:00.421Z Last Updated: 2025-10-09T16:22:51.045Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: MQ Problem Types: CWE-260 Description: IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0 Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7243544
CVE ID: CVE-2025-36104 State: PUBLISHED Published: 2025-07-12T11:30:41.359Z Last Updated: 2025-08-18T01:34:59.319Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Storage Scale Problem Types: CWE-277 Description: IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239562
CVE ID: CVE-2025-36106 State: PUBLISHED Published: 2025-07-21T18:08:09.988Z Last Updated: 2025-08-18T01:32:49.740Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: IBM Products: Cognos Analytics Mobile Problem Types: CWE-326 Description: IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to view and modify information coming to and from the application which could then be used to access confidential information on the device or network by using a the deprecated or misconfigured AFNetworking library at runtime. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239635