CVE Vulnerability Catalog

IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.

IBM MQ versions LTS and CD up to 10.0.0.0 allow a remote authenticated attacker to execute arbitrary code on the system due to deserialization of untrusted data.

IBM MQ versions LTS and CD up to 10.0.0.0 are vulnerable to XML External Entity (XXE) attacks when processing XML data, potentially exposing sensitive information or consuming memory resources.

IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

IBM MQ Managed File Transfer versions LTS and CD up to 10.0.0.0 allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to XML external entity injection in reply message processing.

IBM Verify Identity Access allows a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. The flaw affects how the product processes requests.

IBM Business Automation Workflow (containers and traditional) may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default.

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services, allowing authenticated attackers to inject arbitrary SQL via the format parameter.

MCP Atlassian before 0.22.0 allows a client with write-tool access to pass file paths without confinement to the server, leading to disclosure of server files, Atlassian credentials, or another tenant's data.

Skipper before 0.27.35 has a vulnerability in the opaAuthorizeRequestWithBody filter that allows bypassing deny-on-presence Rego policies for requests with oversized declared Content-Length when the body exceeds the size limit.

SIPSorcery before 10.0.9 has a vulnerability in RTP packet and STUN attribute handling, where insufficient length checks can allow a remote attacker to close the channel, terminating the active RTP or WebRTC media session.

Anyquery before 0.4.5 exposes file-backed SQLite virtual table modules (csv_reader, log_reader) through its MySQL-compatible server port without authentication, allowing a remote attacker to read arbitrary files from the system.

Anyquery prior to 0.4.5 exposes URL-capable SQLite virtual table modules (json_reader, log_reader) through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can supply a loopback, private-network, or link-local URL (e.g. cloud metadata), causing go-getter to fetch the resource and expose the response as queryable table data.

In garminconnect prior to 0.3.5, Client.dump in client.py creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so with umask 022 the directory is 0755 and the file is 0644. garmin_tokens.json contains di_refresh_token, which another unprivileged user on a shared Linux/macOS host can read to gain persistent access to the victim's Garmin Connect account.

In Anyquery prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go passes the caller-controlled plugin parameter through path.Join to os.RemoveAll without rejecting traversal segments. A low-privileged bearer-token holder can invoke it via the /v1/query HTTP endpoint, causing recursive deletion of any directory writable by the Anyquery server process.

PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard (role == REPO_REMOVE || !SIMULATE) is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate.

The NetworkManager-l2tp plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a newline-injected leftupdown directive, which pluto executes as root when the IKE security association is established.

IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols.

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization.