IB
Product
Integration Bus
24
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 1Medium 15Low 2
Watch
Add Integration Bus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9706 | 9.1 | Feb 15 | IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when… Affected: 9.0; 10.0 |
| CVE-2017-1694 | 8.1 | Dec 20 | IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques Affected: 9.0.0.0; 9.0.0.1; 9.0.0.2; 9.0.0.3; 9.0.0.4; 9.0.0.5; +14 more |
| CVE-2025-36014 | 6.7 | Jul 7 | IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.5 is vulnerable to code injection by a privileged user with access to the IIB install directory Affected: 10.1.0.0 through 10.1.0.5 |
| CVE-2024-27265 | 6.5 | Mar 14 | IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… Affected: 10.1 through 10.1.0.3 |
| CVE-2024-22332 | 6.5 | Feb 9 | The IBM Integration Bus for z/OS 10.1 through 10.1.0.2 AdminAPI is vulnerable to a denial of service due to file system exhaustion Affected: 10.1 through 10.1.0.2 |
| CVE-2016-9010 | 6.1 | Feb 15 | IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim Affected: 9.0; 10.0 |
| CVE-2016-8918 | 5.9 | Feb 1 | IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials Affected: 10.0 |
| CVE-2017-1693 | 5.6 | Jan 19 | IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users session during a small timeframe before the session times out Affected: 9.0.0.0; 9.0.0.1; 9.0.0.2; 9.0.0.3; 9.0.0.4; 9.0.0.5; +14 more |
| CVE-2026-3602 | 5.5 | Jun 30 | IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection Affected: 10.1.0.0 through 10.1.0.7 |
| CVE-2023-45176 | 5.5 | Oct 14 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.10.0 and IBM Integration Bus 10.1 through 10.1.0.1 are vulnerable to a denial of service for… Affected: 10.1 |
| CVE-2017-1418 | 5.5 | Nov 26 | IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0.9) has insecure permissions on certain files Affected: 9.0.0.0 through 9.0.0.11; 10.0.0.0 through 10.0.0.14 |
| CVE-2017-1207 | 5.5 | Jul 5 | IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user Affected: 9.0.0; 9.0.0.1; 9.0.0.2; 9.0.0.3; 9.0.0.4; 9.0.0.5; +10 more |
| CVE-2018-1801 | 5.3 | Feb 4 | IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker… Affected: 9.0.0.0; 10.0.0.0; 9.0.0.10; 10.0.0.13 |
| CVE-2017-1126 | 5.3 | Oct 4 | IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that could lead to further… Affected: 9.0.0.0; 9.0.0.1; 9.0.0.2; 9.0.0.4; 9.0.0.5; 9.0.0.6; +12 more |
| CVE-2016-2961 | 5.3 | Jul 2 | The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows remote attackers to obtain sensitive… Affected: 9.0; 9.0.0.1; 9.0.0.2; 9.0.0.3; 9.0.0.4; 9.0.0.5; +5 more |
| CVE-2015-7399 | 5.3 | Jan 11 | IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to obtain sensitive… Affected: 9.0; 9.0.0.1; 9.0.0.2; 10.0 |
| CVE-2024-22356 | 4.9 | Mar 26 | IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.9.0 and IBM Integration Bus for z/OS 10.1 through 10.1.0.2store potentially sensitive information in… Affected: 10.1 before 10.1.0.3 |
| CVE-2016-0394 | 3.3 | Feb 1 | IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files Affected: 9.0; 9.0.0.1; 9.0.0.2; 10.0 |
| CVE-2017-1144 | 2.5 | Jul 5 | IBM WebSphere Message Broker could allow a local user with specialized access to prevent the message broker from starting Affected: 9.0; 9.0.0.1; 9.0.0.2; 9.0.0.3; 9.0.0.4; 9.0.0.5; +10 more |
| CVE-2015-5011 | – | Oct 26 | IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local… Affected: 9.0; 9.0.0.1; 9.0.0.2; 9.0.0.3 |
| CVE-2015-2018 | – | Aug 23 | IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the correct security profile is selected, which… Affected: 9.0; 10.0 |
| CVE-2015-0118 | – | Jun 28 | IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only… Affected: 9.0; 9.0.0.1; 9.0.0.2; 9.0.0.3 |
| CVE-2014-6170 | – | Feb 2 | The HTTPInput node in IBM WebSphere Message Broker 7.0 before 7.0.0.8 and 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.4 allows remote attackers to obtain sensitive… Affected: 9.0; 9.0.0.1; 9.0.0.2; 9.0.0.3 |
| CVE-2014-4819 | – | Sep 18 | The web user interface in IBM WebSphere Message Broker 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.3 allows remote authenticated users to obtain sensitive… Affected: 9.0; 9.0.0.1; 9.0.0.2 |
Showing 24