CVE Vulnerability Catalog

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements.

IBM Langflow OSS versions 1.0.0 through 1.10.2 contain a server-side request forgery (SSRF) vulnerability. A remote authenticated attacker could exploit this to obtain sensitive information.

IBM Langflow OSS versions 1.0.0 through 1.10.2 have an improper authorization vulnerability. A remote authenticated attacker could obtain sensitive information and inject messages into workflow history.

IBM Langflow OSS versions 1.0.0 through 1.10.2 have a vulnerability due to improper limitation of a pathname to a restricted directory. A remote authenticated attacker could obtain sensitive information.

IBM Langflow OSS versions 1.0.0 through 1.10.2 have a directory traversal vulnerability. A remote attacker could send a specially crafted URL request containing 'dot dot' sequences to view arbitrary files on the system.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.1 and 12.0.1.0 through 12.0.12.28, and IBM Integration Bus for z/OS versions 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

IBM App Connect Enterprise and IBM Integration Bus for z/OS write credentials in cleartext to trace logs. A local attacker could access this sensitive information.

IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to uncontrolled recursion, which could lead to denial of service. A local attacker could exploit this.

IBM i versions 7.6, 7.5, 7.4, and 7.3 have predictable server seeds, allowing a remote authenticated attacker to bypass security restrictions.

IBM i versions 7.6, 7.5, 7.4, and 7.3 are prone to a NULL pointer dereference, allowing a remote authenticated attacker to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 have a stack-based buffer overflow vulnerability that a local attacker could exploit to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 are vulnerable to a stack-based buffer overflow, allowing a remote authenticated attacker to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 improperly validate the prefix length in ICMPv6 Router Advertisements, allowing a remote attacker to cause a denial of service.

IBM i versions 7.6, 7.5, 7.4, and 7.3 have a buffer overflow vulnerability that a remote attacker could exploit to cause a denial of service and compromise integrity.

IBM i versions 7.6, 7.5, 7.4, and 7.3 lack authentication for critical functions, allowing a remote attacker to cause a denial of service and affect data integrity.