SF
Product
Sterling File Gateway
On CISA KEVExploited in the wild
206
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 28Medium 134Low 3
Watch
Add Sterling File Gateway to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-45089 | 4.3 | Jan 31 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition EBICS server could allow an authenticated user to obtain sensitive filename… Affected: 6.0.0.0 through 6.1.2.5; 6.2.0.0 through 6.2.0.3 |
| CVE-2023-42016 | 4.3 | Feb 9 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or session cookies Affected: 6.0.0.0 through 6.0.3.8; 6.1.0.0 through 6.1.2.3 |
| CVE-2021-38954 | 4.3 | Jun 30 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could disclose sensitive version information that could aid in future attacks… Affected: 6.0.0.0 through 6.0.3.5; 6.1.0.0 through 6.1.1.0 |
| CVE-2021-29700 | 4.3 | Oct 7 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authneticated attacker to obtain sensitive information from configuration files that could aid… Affected: 5.2.0.0 through 5.2.6.5_4; 6.0.0.0 through 6.0.0.6; 6.0.1.0 through 6.0.3.4; 6.1.0.0 through 6.1.0.2 |
| CVE-2021-20376 | 4.3 | Oct 7 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to there being an observable discrepancy in returned messages Affected: 2.2.0.0 through 5.2.6.5_3; 6.0.0.0 through 6.0.3.4; 6.1.0.0 through 6.1.0.1 |
| CVE-2021-20372 | 4.3 | Oct 7 | IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another user's service due to insufficient permission checking Affected: 2.2.0.0 through 5.2.6.5_3; 6.0.0.0 through 6.0.0.6; 6.0.1.0 through 6.0.3.4; 6.1.0.0 through 6.1.0.1 |
| CVE-2021-29761 | 4.3 | Oct 6 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information from the dashboard that they should not have… Affected: 5.2.0.0 through 6.1.0.3 |
| CVE-2021-29760 | 4.3 | Oct 6 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files through the dashboard user interface Affected: 5.2.0.0 through 6.1.0.3 |
| CVE-2021-29758 | 4.3 | Oct 6 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to perform actions that they should not be able to access due to improper… Affected: 5.2.0.0 through 6.1.0.3 |
| CVE-2020-4646 | 4.3 | May 19 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5, 6.0.0.0 through 6.0.3.3, and 6.1.0.0 through 6.1.0.2 could allow an authenticated user to view pages they… Affected: 5.2.0.0 through 5.2.6.5; 6.0.0.0 through 6.0.3.3; 6.1.0.0 through 6.1.0.2 |
| CVE-2020-4312 | 4.3 | May 13 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensitive information from a cached web page Affected: 5.2.0.0 through 5.2.6.5; 6.0.0.0 through 6.0.3.1 |
| CVE-2019-4726 | 4.3 | Feb 26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and… Affected: 5.2.0.0 through 6.0.3.0 |
| CVE-2019-4377 | 4.3 | Jun 25 | IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system Affected: 5.2.0.0 through 6.0.0.1 |
| CVE-2019-4222 | 4.3 | Apr 25 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without permission Affected: 6.0.0.0; 6.0.0.1 |
| CVE-2017-1633 | 4.3 | Jul 20 | IBM Sterling B2B Integrator 5.2 through 5.2.6 could allow an authenticated attacker to obtain sensitive variable name information using specially crafted HTTP requests Affected: 5.2.0.1 through 5.2.6.3 |
| CVE-2017-1481 | 4.3 | Dec 7 | IBM Sterling B2B Integrator Standard Edition 5.2 allows a user to view sensitive information that belongs to another user Affected: 5.2 |
| CVE-2017-1326 | 4.3 | Jun 22 | IBM Sterling File Gateway does not properly restrict user requests based on permission level Affected: 5.2 |
| CVE-2025-1348 | 4.0 | Jun 18 | IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure Affected: 6.0.0.0 through 6.1.2.6; 6.2.0.0 through 6.2.0.4 |
| CVE-2023-42010 | 3.7 | Jul 17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 could disclose sensitive information in the HTTP response using man in the middle… Affected: 6.0.0.0 through 6.1.2.5; 6.2.0.0 through 6.2.0.2 |
| CVE-2019-4146 | 3.1 | Apr 25 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to obtain sensitive document information under unusual circumstances Affected: 6.0.0.0; 6.0.0.1 |
| CVE-2024-52905 | 2.7 | Mar 10 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 could disclose sensitive database information to a privileged user Affected: 6.0.0.0 before 6.1.2.7; 6.2 before 6.2.0.4 |
| CVE-2015-5019 | – | Nov 8 | IBM Sterling Integrator 5.1 before 5010004_8 and Sterling B2B Integrator 5.2 before 5020500_9 allow remote authenticated users to read or upload files by leveraging a… Affected: 5.2 |
| CVE-2015-4992 | – | Oct 6 | IBM Sterling B2B Integrator 5.2 before 5020500_8 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors Affected: 5.2 |
| CVE-2014-6199 | – | Jan 10 | The HTTP Server Adapter in IBM Sterling B2B Integrator 5.1 and 5.2.x and Sterling File Gateway 2.1 and 2.2 allows remote attackers to cause a denial of service (connection-slot… Affected: 5.1; 5.2; 5.2.1; 5.2.2; 5.2.4; 5.2.4.1; +2 more |
| CVE-2014-6146 | – | Nov 8 | IBM Sterling B2B Integrator 5.2.x through 5.2.4, when the Connect:Direct Server Adapter is configured, does not properly process the logging configuration, which allows local… Affected: 5.2.1; 5.2.2; 5.2.4 |
| CVE-2014-6099 | – | Oct 26 | The Change Password feature in IBM Sterling B2B Integrator 5.2.x through 5.2.4 does not have a lockout protection mechanism for invalid login requests, which makes it easier for… Affected: 5.2; 5.2.4 |
| CVE-2013-5413 | – | Dec 21 | IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not invalidate a session upon a logout action, which allows remote attackers to bypass authentication by… Affected: 5.2 |
| CVE-2013-5411 | – | Dec 21 | IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote attackers to inject links and trigger unintended navigation or actions via unspecified vectors Affected: 5.2 |
| CVE-2013-5409 | – | Dec 21 | Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to execute arbitrary SQL commands via… Affected: 5.2 |
| CVE-2013-5407 | – | Dec 21 | IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements, which allows remote authenticated users to bypass intended access… Affected: 5.2 |
| CVE-2013-5406 | – | Dec 21 | Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web… Affected: 5.2 |
| CVE-2013-5405 | – | Dec 21 | Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web… Affected: 5.2 |
| CVE-2013-0494 | – | Aug 9 | IBM Sterling B2B Integrator 5.0 and 5.1 allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted HTTP (1) Range or (2) Request-Range header Affected: 5.0; 5.1 |
| CVE-2013-4002 | – | Jul 23 | XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1… Affected: 5.2.4; 5.1; 5.2 |
| CVE-2013-3020 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via… Affected: 5.1; 5.2 |
| CVE-2013-2987 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via… Affected: 5.1; 5.2 |
| CVE-2013-2985 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via… Affected: 5.1; 5.2 |
| CVE-2013-2984 | – | Jul 3 | Directory traversal vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote authenticated users to read or modify files via… Affected: 5.1; 5.2 |
| CVE-2013-2982 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to upload arbitrary files via unspecified vectors Affected: 5.1; 5.2 |
| CVE-2013-0568 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via… Affected: 5.1; 5.2 |
| CVE-2013-0567 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via… Affected: 5.1; 5.2 |
| CVE-2013-0560 | – | Jul 3 | Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to execute arbitrary SQL… Affected: 5.1; 5.2 |
| CVE-2013-0558 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to obtain sensitive information about application implementation via… Affected: 5.1; 5.2 |
| CVE-2013-0539 | – | Jul 3 | An unspecified third-party component in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 uses short session ID values, which makes it easier for… Affected: 5.1; 5.2 |
| CVE-2013-0481 | – | Jul 3 | The console in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers to read stack traces by triggering (1) an error or (2) an… Affected: 5.1; 5.2 |
| CVE-2013-0479 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not properly restrict file types and extensions, which allows remote authenticated users to bypass… Affected: 5.1; 5.2 |
| CVE-2013-0476 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to inject arbitrary FTP commands via unspecified vectors Affected: 5.1; 5.2 |
| CVE-2013-0475 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via… Affected: 5.1; 5.2 |
| CVE-2013-0468 | – | Jul 3 | Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote authenticated users to inject arbitrary web… Affected: 5.1; 5.2 |
| CVE-2013-0463 | – | Jul 3 | IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via… Affected: 5.1; 5.2 |