rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-36003 IBM Security Verify Governance Identity Manager information disclosure
IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are returned. This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: Security Verify Governance Identity Manager
cpes: cpe:2.3:a:ibm:security_verify_governance:10.0.2:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-08-28T02:07:51.600Z
CVE-2025-36004 IBM i privilege escalation
IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious actor could cause user-controlled code to run with administrator privilege.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: IBM
product: i
cpes: cpe:2.3:a:ibm:i:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Zoltan Panczel
Published: 2025-06-25T02:32:40.332Z
CVE-2025-36005 IBM MQ Operator information disclosure
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the proxy to the same hostname and port due to improper certificate validation.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: IBM
product: MQ Operator
cpes: cpe:2.3:a:ibm:mq_operator:2.0.0:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq_operator:2.0.29:*:*:*:lts:*:*:*
default_status: unaffected
vendor: IBM
product: MQ Operator
cpes: cpe:2.3:a:ibm:mq_operator:3.0.0:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq_operator:3.0.1:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq_operator:3.1.0:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq_operator:3.1.3:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq_operator:3.3.0:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq_operator:3.4.0:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq_operator:3.4.1:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq_operator:3.5.0:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq_operator:3.5.1:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq_operator:3.6.0:*:*:*:continuous_delivery:*:*:*
default_status: unaffected
vendor: IBM
product: MQ Operator
cpes: cpe:2.3:a:ibm:mq_operator:3.2.0:*:*:*:support_cycle_2:*:*:*
cpe:2.3:a:ibm:mq_operator:3.2.13:*:*:*:support_cycle_2:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-07-24T14:52:53.238Z
CVE-2025-36006 IBM Db2 denial of service
IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources after use.
Problem types: cwe_id: CWE-404
description: CWE-404 Improper Resource Shutdown or Release
Affected products: vendor: IBM
product: Db2
cpes: cpe:2.3:a:ibm:db2:10.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.1.4.7:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:10.5.11:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-11-07T19:04:05.595Z
CVE-2025-36007 IBM QRadar SIEM incorrect privilege assignment
IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update script.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: IBM
product: QRadar SIEM
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed,Dawid Bak
Published: 2025-10-27T18:40:16.046Z
CVE-2025-36008 IBM Db2 denial of service
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper allocation of resources.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: IBM
product: Db2
cpes: cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-11-07T18:57:09.615Z
CVE-2025-36009 IBM Db2 Denial of Service
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a global variable.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.3:*:*:*:*:zos:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-01-30T21:28:12.081Z
CVE-2025-36010 IBM Db2 for Linux denial of service
IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 

could allow an unauthenticated user to cause a denial of service due to executable segments that are waiting for each other to release a necessary lock.
Problem types: cwe_id: CWE-833
description: CWE-833 Deadlock
Affected products: vendor: IBM
product: Db2
cpes: cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.2:*:*:*:*:linux:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-29T18:13:20.677Z
CVE-2025-36011 IBM Jazz for Service Management information disclosure
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Problem types: cwe_id: CWE-614
description: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: IBM
product: Jazz for Service Management
cpes: cpe:2.3:a:ibm:jazz_for_service_management:1.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:jazz_for_service_management:1.1.3.24:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-09-09T19:32:16.786Z
CVE-2025-36014 IBM Integration Bus for z/OS code injection
IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.5 is vulnerable to code injection by a privileged user with access to the IIB install directory.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: IBM
product: Integration Bus
cpes: cpe:2.3:a:ibm:integration_bus:10.1:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:integration_bus:10.1.0.5:*:*:*:*:zos:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-07-07T16:15:53.537Z
CVE-2025-36015 IBM Controller Denial of Service
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: IBM
product: Controller
cpes: cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:controller:11.1.1:*:*:*:*:*:*:*
vendor: IBM
product: Cognos Controller
cpes: cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:11.0.1:FP6:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-12-08T21:22:45.698Z
CVE-2025-36016 IBM Process Mining HTTP open redirect
IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: IBM
product: Process Mining
cpes: cpe:2.3:a:ibm:process_mining:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:process_mining:2.0.1:interm_fix1:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Published: 2025-06-21T12:38:18.175Z
CVE-2025-36017 IBM Controller Information Disclosure
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.
Problem types: cwe_id: CWE-526
description: CWE-526
Affected products: vendor: IBM
product: Controller
cpes: cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:controller:11.1.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-12-08T21:37:10.807Z
CVE-2025-36018 Multiple Vulnerabilities in IBM Concert Software.
IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: IBM
product: Concert
cpes: cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:2.1.0:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Published: 2026-02-17T18:54:45.329Z
CVE-2025-36019 Multiple Vulnerabilities in IBM Concert Software.
IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: Concert
cpes: cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:2.1.0:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-02-17T18:53:09.408Z
CVE-2025-36020 IBM Guardium Data Protection information disclosure
IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information.
Problem types: cwe_id: CWE-319
description: CWE-319
Affected products: vendor: IBM
product: Guardium Data Protection
cpes: cpe:2.3:a:ibm:security_guardium:11.5:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Pedro Cornago Lopez @ Nordea Bank Abp
Published: 2025-08-06T14:28:45.780Z
CVE-2025-36023 IBM Cloud Pak for Business Automation security bypass
IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: IBM
product: Cloud Pak for Business Automation
cpes: cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.0:ifix5:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_for_business_automation:24.0.1:ifix2:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-08-08T14:51:12.631Z
CVE-2025-36026 IBM Datacap information disclosure
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 

does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Problem types: cwe_id: CWE-614
description: CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: IBM
product: Datacap
cpes: cpe:2.3:a:ibm:datacap:9.1.7:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datacap:9.1.8:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datacap:9.1.9:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-06-28T00:49:54.932Z
CVE-2025-36027 IBM Datacap clickjacking
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 



could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
Problem types: cwe_id: CWE-1021
description: CWE-1021 Improper Restriction of Rendered UI Layers or Frames
Affected products: vendor: IBM
product: Datacap
cpes: cpe:2.3:a:ibm:datacap:9.1.7:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datacap:9.1.8:*:*:*:*:*:*:*
cpe:2.3:a:ibm:datacap:9.1.9:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-06-28T00:51:07.042Z
CVE-2025-36033 IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting
IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: Engineering Lifecycle Management - Global Configuration Management
cpes: cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.0.3:interim_fix_017:*:*:*:*:*:*
cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:engineering_lifecycle_management___global_configuration_management:7.1.0:interim_fix_004:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-02-03T22:12:29.853Z
CVE-2025-36034 IBM InfoSphere DataStage Flow Designer information disclosure
IBM InfoSphere DataStage Flow Designer in IBM InfoSphere Information Server 11.7 discloses sensitive user information in API requests in clear text that could be intercepted using man in the middle techniques.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-06-26T15:14:10.478Z
CVE-2025-36035 IBM PowerVM Hypervisor denial of service
IBM PowerVM Hypervisor FW950.00 through FW950.E0, FW1050.00 through FW1050.50, and FW1060.00 through FW1060.40 could allow a local privileged user to cause a denial of service by issuing a specially crafted IBM i hypervisor call that would disclose memory contents or consume excessive memory resources.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: IBM
product: PowerVM Hypervisor
cpes: cpe:2.3:o:ibm:power9_system_firmware:fw950.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power9_system_firmware:fw950.E0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power9_system_firmware:fw1050.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power9_system_firmware:fw1050.50:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power9_system_firmware:fw1060.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power9_system_firmware:fw1060.40:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H
version: 3.1
Published: 2025-09-14T12:52:48.871Z