Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-36107 State: PUBLISHED Published: 2025-07-21T18:07:13.217Z Last Updated: 2025-08-18T01:33:40.490Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cognos Analytics Mobile Problem Types: CWE-319 Description: IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to obtain sensitive information due to the cleartext transmission of data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239635
CVE ID: CVE-2025-36112 State: PUBLISHED Published: 2025-11-24T18:25:03.423Z Last Updated: 2025-11-24T18:58:40.859Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling B2B Integrator, Sterling File Gateway Problem Types: CWE-497 Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could reveal sensitive server IP configuration information to an unauthorized user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7252197
CVE ID: CVE-2025-36114 State: PUBLISHED Published: 2025-08-20T14:37:38.331Z Last Updated: 2025-08-20T14:56:15.871Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: QRadar SOAR Plugin App Problem Types: CWE-20 Description: IBM QRadar SOAR Plugin App 1.0.0 through 5.6.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242664
CVE ID: CVE-2025-36116 State: PUBLISHED Published: 2025-07-23T14:26:06.865Z Last Updated: 2025-08-18T01:30:27.202Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Db2 Mirror for i Problem Types: CWE-1385 Description: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that the user is not allowed to perform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/
wed to perform. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240351
CVE ID: CVE-2025-36117 State: PUBLISHED Published: 2025-07-23T14:27:08.061Z Last Updated: 2025-08-18T01:30:05.928Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Db2 Mirror for i Problem Types: CWE-384 Description: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240351
CVE ID: CVE-2025-36118 State: PUBLISHED Published: 2025-11-17T20:47:48.824Z Last Updated: 2025-11-17T20:57:45.516Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Storage Virtualize Problem Types: CWE-244 Description: IBM Storage Virtualize 8.4, 8.5, 8.7, and 9.1 IKEv1 implementation allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250954
CVE ID: CVE-2025-36119 State: PUBLISHED Published: 2025-08-08T14:25:40.141Z Last Updated: 2025-08-13T15:03:46.275Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: IBM Products: i Problem Types: CWE-290 Description: IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web session hijacking vulnerability. An authenticated user without administrator privileges could exploit this vulnerability to perform actions in DCM as an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7241008
CVE ID: CVE-2025-36120 State: PUBLISHED Published: 2025-08-18T13:39:41.381Z Last Updated: 2025-08-19T03:55:31.062Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Storage Virtualize Problem Types: CWE-863 Description: IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240796
CVE ID: CVE-2025-36121 State: PUBLISHED Published: 2025-10-27T14:56:07.466Z Last Updated: 2025-10-27T18:51:26.399Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: OpenPages Problem Types: CWE-80 Description: IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7248932
CVE ID: CVE-2025-36124 State: PUBLISHED Published: 2025-08-12T18:45:24.453Z Last Updated: 2025-08-12T20:37:21.958Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: WebSphere Application Server Liberty Problem Types: CWE-268 Description: IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242027
CVE ID: CVE-2025-36125 State: PUBLISHED Published: 2025-09-09T19:27:58.502Z Last Updated: 2025-09-09T19:41:48.323Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Hardware Management Console Problem Types: CWE-79 Description: IBM Hardware Management Console - Power 10.3.1050.0 and 11.1.1110.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/nod
trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244336
CVE ID: CVE-2025-36128 State: PUBLISHED Published: 2025-10-16T16:49:26.251Z Last Updated: 2025-10-16T18:13:32.234Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ Problem Types: CWE-772 Description: IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244480
CVE ID: CVE-2025-36131 State: PUBLISHED Published: 2025-11-07T18:53:45.472Z Last Updated: 2025-11-07T19:06:54.110Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Db2 Problem Types: CWE-359 Description: IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access to the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250484
CVE ID: CVE-2025-36132 State: PUBLISHED Published: 2025-09-30T19:41:19.912Z Last Updated: 2025-09-30T20:40:56.983Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Planning Analytics Local Problem Types: CWE-79 Description: IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/
rusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246602
CVE ID: CVE-2025-36133 State: PUBLISHED Published: 2025-09-01T11:56:19.981Z Last Updated: 2025-09-02T20:33:30.540Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: IBM Products: App Connect Enterprise Certified Container Problem Types: CWE-532 Description: IBM App Connect Enterprise Certified Container CD: 9.2.0 through 11.6.0, 12.1.0 through 12.14.0, and 12.0 LTS: 12.0.0 through 12.0.14stores potentially sensitive information in log files during installation that could be read by a local user on the container. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7243690
CVE ID: CVE-2025-36135 State: PUBLISHED Published: 2025-11-07T18:26:57.845Z Last Updated: 2025-11-07T18:47:27.813Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator, Sterling File Gateway Problem Types: CWE-79 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur
rary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250509
CVE ID: CVE-2025-36136 State: PUBLISHED Published: 2025-11-07T18:45:46.550Z Last Updated: 2025-11-07T18:53:53.234Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 Problem Types: CWE-770 Description: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor script incorrectly detecting that the instance is still starting under specific conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250485
CVE ID: CVE-2025-36137 State: PUBLISHED Published: 2025-10-30T18:53:32.576Z Last Updated: 2025-11-01T03:55:53.155Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Sterling Connect:Direct for Unix Problem Types: CWE-250 Description: IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns permissions for maintenance tasks to Control Center Director (CCD) users that could allow a privileged user to escalate their privileges further due to unnecessary privilege assignment for post update scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
r due to unnecessary privilege assignment for post update scripts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249678
CVE ID: CVE-2025-36138 State: PUBLISHED Published: 2025-10-27T18:47:11.153Z Last Updated: 2025-10-27T19:27:11.083Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: QRadar SIEM Problem Types: CWE-79 Description: IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249278
CVE ID: CVE-2025-36139 State: PUBLISHED Published: 2025-09-18T15:13:10.913Z Last Updated: 2025-09-19T17:09:30.745Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: watsonx.data Problem Types: CWE-79 Description: IBM Lakehouse (watsonx.data 2.2) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7245387
CVE ID: CVE-2025-36143 State: PUBLISHED Published: 2025-09-18T15:14:41.611Z Last Updated: 2025-09-19T17:09:23.671Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: watsonx.data Problem Types: CWE-78 Description: IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7245379
CVE ID: CVE-2025-36144 State: PUBLISHED Published: 2025-09-27T00:05:08.668Z Last Updated: 2025-09-29T14:04:30.872Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: watsonx.data Problem Types: CWE-532 Description: IBM Lakehouse (watsonx.data 2.2) stores potentially sensitive information in log files that could be read by a local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246267
CVE ID: CVE-2025-36146 State: PUBLISHED Published: 2025-09-18T15:15:58.809Z Last Updated: 2025-09-19T17:09:17.223Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: watsonx.data Problem Types: CWE-497 Description: IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7245384
CVE ID: CVE-2025-36149 State: PUBLISHED Published: 2025-11-21T19:38:47.251Z Last Updated: 2025-11-21T19:48:34.076Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: IBM Concert Software Problem Types: CWE-1021 Description: IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7252019
CVE ID: CVE-2025-36150 State: PUBLISHED Published: 2025-11-24T20:29:19.183Z Last Updated: 2025-11-24T20:58:29.449Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Concert Problem Types: CWE-327 Description: IBM Concert 1.0.0 through 2.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7252019
CVE ID: CVE-2025-36153 State: PUBLISHED Published: 2025-11-20T21:21:04.869Z Last Updated: 2025-11-20T21:35:26.690Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Concert Problem Types: CWE-79 Description: IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7252019
CVE ID: CVE-2025-36156 State: PUBLISHED Published: 2025-10-07T17:36:57.964Z Last Updated: 2025-10-08T03:55:22.946Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: InfoSphere Data Replication VSAM for z/OS Remote Source Problem Types: CWE-119 Description: IBM InfoSphere Data Replication VSAM for z/OS Remote Source 11.4 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with access to the files storing CECSUB or CECRM on the container could overflow the buffer and execute arbitrary code on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node
e on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247224
CVE ID: CVE-2025-36157 State: PUBLISHED Published: 2025-08-24T01:14:41.359Z Last Updated: 2025-08-26T14:46:31.452Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Engineering Lifecycle Management Problem Types: CWE-863 Description: IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242925
CVE ID: CVE-2025-36158 State: PUBLISHED Published: 2025-11-20T21:19:26.619Z Last Updated: 2025-11-20T21:36:03.920Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Concert Problem Types: CWE-674 Description: IBM Concert 1.0.0 through 2.0.0 could allow a local user with specific permission to obtain sensitive information from files due to uncontrolled recursive directory copying. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7252019
CVE ID: CVE-2025-36159 State: PUBLISHED Published: 2025-11-20T21:17:47.926Z Last Updated: 2025-11-20T21:36:49.144Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Concert Problem Types: CWE-117 Description: IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to improper neutralization of output. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7252019
CVE ID: CVE-2025-36160 State: PUBLISHED Published: 2025-11-20T21:15:35.003Z Last Updated: 2025-11-20T21:34:12.859Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Concert Problem Types: CWE-497 Description: IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7252019
CVE ID: CVE-2025-36161 State: PUBLISHED Published: 2025-11-20T15:26:29.342Z Last Updated: 2025-11-20T16:30:00.600Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Concert Problem Types: CWE-327 Description: IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7252019
CVE ID: CVE-2025-36162 State: PUBLISHED Published: 2025-09-02T18:52:08.189Z Last Updated: 2025-09-02T19:46:21.658Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: UrbanCode Deploy Problem Types: CWE-497 Description: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8.1 before 8.1.2.2 could allow an authenticated user to obtain sensitive information about configuration on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7243830
CVE ID: CVE-2025-36170 State: PUBLISHED Published: 2025-10-27T18:46:38.109Z Last Updated: 2025-10-27T19:32:23.075Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: QRadar SIEM Problem Types: CWE-79 Description: IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7249278
CVE ID: CVE-2025-36171 State: PUBLISHED Published: 2025-10-09T13:57:51.884Z Last Updated: 2025-10-09T14:15:08.708Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-770 Description: IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7247502
CVE ID: CVE-2025-36172 State: PUBLISHED Published: 2025-11-03T21:18:09.139Z Last Updated: 2025-11-03T21:41:45.434Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cloud Pak for Business Automation Problem Types: CWE-79 Description: IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM Business Automation Workflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially lea
enticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7250047
CVE ID: CVE-2025-36174 State: PUBLISHED Published: 2025-08-24T01:21:41.929Z Last Updated: 2025-08-26T03:55:29.531Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Integrated Analytics System Problem Types: CWE-434 Description: IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242970