IBM i vulnerabilities

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability.

IBM i versions 7.6, 7.5, 7.4, and 7.3 are vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specially crafted message and downgrade the Transport Layer Security (TLS) protocol to a version disabled in the server configuration.

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a denial-of-service attack due to uncontrolled recursion in the Integrated Language Environment (ILE) compiler. An authenticated attacker could exploit this by compiling specially crafted source code containing a specific combination of statements.

IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check. A malicious actor could cause user-controlled code to run with administrator privilege.

IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 are impacted by an information disclosure vulnerability in the database plan cache implementation. A user with access to the database plan cache could see information they do not have authority to view.

IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 is vulnerable to privilege escalation caused by an invalid IBM i SQL services authorization check. A malicious actor can use the elevated privileges of another user profile to gain root access to the host operating system.