rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-33111 IBM Controller Information Disclosure
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks.
Problem types: cwe_id: CWE-379
description: CWE-379 Creation of Temporary File in Directory with Insecure Permissions
Affected products: vendor: IBM
product: Controller
cpes: cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:controller:11.1.1:*:*:*:*:*:*:*
vendor: IBM
product: Cognos Controller
cpes: cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:11.0.1:FP6:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-12-08T21:28:37.212Z
CVE-2025-33112 IBM AIX command execution
IBM AIX 7.3 and IBM VIOS 4.1.1 Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary code due to improper neutralization of pathname input.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: IBM
product: AIX
cpes: cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*
default_status: unaffected
vendor: IBM
product: VIOS
cpes: cpe:2.3:a:ibm:vios:4.1.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-06-10T16:28:44.355Z
CVE-2025-33114 IBM Db2 for Linux denial of service
IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 



is vulnerable to denial of service with a specially crafted query under certain non-default conditions.
Problem types: cwe_id: CWE-943
description: CWE-943 Improper Neutralization of Special Elements in Data Query Logic
Affected products: vendor: IBM
product: Db2
cpes: cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.2:*:*:*:*:linux:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-29T18:41:15.788Z
CVE-2025-33116 IBM Watson Studio on Cloud Pak for Data cross-site scripting
IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: IBM
product: Watson Studio on Cloud Pak for Data
cpes: cpe:2.3:a:ibm:watson_studio_on_cloud_pak_for_data:4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:watson_studio_on_cloud_pak_for_data:5.2.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-09-25T15:10:22.592Z
CVE-2025-33117 IBM QRadar SIEM command execution
IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12  could allow a privileged user to modify configuration files that would allow the upload of a malicious autoupdate file to execute arbitrary commands.
Problem types: cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: IBM
product: QRadar SIEM
cpes: cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed, Dawid Bak
Published: 2025-06-19T17:16:41.195Z
CVE-2025-33118 IBM QRadar SIEM cross-site scripting
IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: IBM
product: QRadar SIEM
cpes: cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed, Dawid Bak
Published: 2025-08-01T17:21:16.808Z
CVE-2025-33119 IBM QRadar SIEM Information Disclosure
IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user.
Problem types: cwe_id: CWE-260
description: CWE-260 Password in Configuration File
Affected products: vendor: IBM
product: QRadar Security Information and Event Management
cpes: cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_14:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Acknowledgement John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed, and Dawid Bak from the IBM Security Ethical Hacking Team.
Published: 2025-11-12T21:19:55.966Z
CVE-2025-33120 IBM QRadar SIEM privilege escalation
IBM QRadar SIEM 7.5 through 7.5.0 UP13 could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unnecessary privileges.
Problem types: cwe_id: CWE-250
description: CWE-250
Affected products: vendor: IBM
product: QRadar SIEM
cpes: cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed, Dawid Bak
Published: 2025-08-22T14:54:02.504Z
CVE-2025-33121 IBM QRadar SIEM XML external entity injection
IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12  is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: IBM
product: QRadar SIEM
cpes: cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed, Dawid Bak
Published: 2025-06-19T17:14:42.786Z
CVE-2025-33122 IBM i privilege escalation
IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 could allow a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job Scheduler for i. A malicious actor could cause user-controlled code to run with administrator privilege.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: IBM
product: i
cpes: cpe:2.3:a:ibm:i:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-06-17T17:13:00.835Z
CVE-2025-33124 Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows
IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an authenticated user to cause the program to crash due to the incorrect calculation of a buffer size.
Problem types: cwe_id: CWE-131
description: CWE-131 Incorrect Calculation of Buffer Size
Affected products: vendor: IBM
product: DB2 Merge Backup for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2_merge_backup_for_linux_unix_and_windows:12.1.0.0:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-02-17T19:13:21.530Z
CVE-2025-33126 Fixes to common vulnerabilities found in IBM Db2 High Performance Unload
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, 5.1, 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to the incorrect calculation of a buffer size.
Problem types: cwe_id: CWE-131
description: CWE-131 Incorrect Calculation of Buffer Size
Affected products: vendor: IBM
product: DB2 High Performance Unload
cpes: cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0.0:interm_fix1:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0.0:if1:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-10-27T23:56:06.271Z
CVE-2025-33130 Fixes to common vulnerabilities found in IBM Db2 Merge Backup for Linux, UNIX and Windows
IBM DB2 Merge Backup for Linux, UNIX and Windows 12.1.0.0 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: IBM
product: DB2 Merge Backup for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2_merge_backup_for_linux_unix_and_windows:12.1.0.0:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-02-17T19:14:48.468Z
CVE-2025-33131 Fixes to common vulnerabilities found in IBM Db2 High Performance Unload
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: IBM
product: DB2 High Performance Unload
cpes: cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0.0:interm_fix1:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0.0:if1:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-10-27T23:56:34.181Z
CVE-2025-33132 Fixes to common vulnerabilities found in IBM Db2 High Performance Unload
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due to the incorrect calculation of the size of the data that is being pointed to.
Problem types: cwe_id: CWE-467
description: CWE-467 Use of sizeof() on a Pointer Type
Affected products: vendor: IBM
product: DB2 High Performance Unload
cpes: cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0.0:interm_fix1:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0.0:if1:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-10-27T23:57:12.201Z
CVE-2025-33133 Fixes to common vulnerabilities found in IBM Db2 High Performance Unload
IBM DB2 High Performance Unload 6.1.0.3, 5.1.0.1, 6.1.0.2, 6.5, 6.5.0.0 IF1, 6.1.0.1, 6.1, and 5.1 could allow an authenticated user to cause the program to crash due an out of bounds write.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: IBM
product: DB2 High Performance Unload
cpes: cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0.0:interm_fix1:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.5.0.0:if1:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:db2_high_performance_unload:5.1.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-10-27T23:57:31.927Z
CVE-2025-33135 IBM Financial Transaction Manager for ACH Services and Check Services is impacted by multiple vulnerabilities
IBM Financial Transaction Manager for ACH Services and Check Services for Multi-Platform 3.0.0.0 through 3.0.5.4 Interim Fix 027 IBM Financial Transaction Manager for Check Services v3 (Multiplatforms) is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: IBM
product: Financial Transaction Manager for ACH Services and Check Services for Multi-Platform
cpes: cpe:2.3:a:ibm:financial_transaction_manager_for_ach_services_and_check_services_for_multi_platform:3.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:financial_transaction_manager_for_ach_services_and_check_services_for_multi_platform:3.0.5.4:interim_fix_027:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-02-17T21:37:06.237Z
CVE-2025-33136 IBM Aspera Faspex data modification
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to improper protection of assumed immutable data.
Problem types: cwe_id: CWE-471
description: CWE-471 Modification of Assumed-Immutable Data (MAID)
Affected products: vendor: IBM
product: Aspera Faspex
cpes: cpe:2.3:a:ibm:aspera_faspex:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aspera_faspex:5.0.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2025-05-22T16:14:02.649Z
CVE-2025-33137 IBM Aspera Faspex data modification
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side security.
Problem types: cwe_id: CWE-602
description: CWE-602 Client-Side Enforcement of Server-Side Security
Affected products: vendor: IBM
product: Aspera Faspex
cpes: cpe:2.3:a:ibm:aspera_faspex:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aspera_faspex:5.0.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2025-05-22T16:36:04.256Z
CVE-2025-33138 IBM Aspera Faspex HTML injection
IBM Aspera Faspex 5.0.0 through 5.0.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: IBM
product: Aspera Faspex
cpes: cpe:2.3:a:ibm:aspera_faspex:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aspera_faspex:5.0.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-05-22T16:37:28.698Z
CVE-2025-33142 IBM WebSphere Application Server information disclosure
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: IBM
product: WebSphere Application Server
cpes: cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-08-14T15:41:59.719Z
CVE-2025-33150 IBM Cognos Analytics Certified Containers information disclosure
IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: IBM
product: Cognos Analytics Certified Containers
cpes: cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-11-10T19:33:55.421Z