Ibm Websphere Mq vulnerabilities

91 known vulnerabilities affecting ibm/websphere_mq.

Total CVEs

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

CRITICAL3HIGH18MEDIUM58LOW12

Vulnerabilities

Page 1 of 5

CVE-2012-2201HIGHCVSS 7.5v7.12022-09-29

CVE-2012-2201 [HIGH] CVE-2012-2201: IBM WebSphere MQ 7.1 is vulnerable to a denial of service, caused by an error when handling user ids IBM WebSphere MQ 7.1 is vulnerable to a denial of service, caused by an error when handling user ids. A remote attacker could exploit this vulnerability to bypass the security configuration setup on a SVRCONN channel and flood the queue manager.

nvd

CVE-2021-38949MEDIUMCVSS 5.5v7.52021-11-16

CVE-2021-38949 [MEDIUM] CWE-312 CVE-2021-38949: IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403.

nvd

CVE-2020-4682CRITICALCVSS 9.8v7.5.0.0v7.5.0.1+8 more2021-01-28

CVE-2020-4682 [CRITICAL] CWE-502 CVE-2020-4682: IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary co IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.

nvd

CVE-2020-4310HIGHCVSS 7.5v7.1v7.52020-06-16

CVE-2020-4310 [HIGH] CVE-2020-4310: IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of ser IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic. IBM X-Force ID: 177081.

cvelistv5nvd

CVE-2019-4619MEDIUMCVSS 5.5≥ 7.1.0.0, ≤ 7.5.0.92020-03-16

CVE-2019-4619 [MEDIUM] CWE-209 CVE-2019-4619: IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 168862.

nvd

CVE-2019-4656MEDIUMCVSS 6.5≥ 7.1.0.0, ≤ 7.5.0.92020-03-16

CVE-2019-4656 [MEDIUM] CVE-2019-4656: IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to crash the queue and require a restart due to an error processing error messages. IBM X-Force ID: 170967.

nvd

CVE-2019-4719MEDIUMCVSS 5.5≥ 7.1.0.0, ≤ 7.5.0.92020-03-16

CVE-2019-4719 [MEDIUM] CVE-2019-4719: IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data.

nvd

CVE-2012-4863MEDIUMCVSS 6.5≥ 7.1.0.0, < 7.1.0.2≥ 7.5.0.0, < 7.5.0.1+2 more2020-01-23

CVE-2012-4863 [MEDIUM] CWE-400 CVE-2012-4863: IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability

cvelistv5nvd

CVE-2019-4141MEDIUMCVSS 6.5≥ 7.1.0.0, ≤ 7.1.0.9≥ 7.5.0.0, ≤ 7.5.0.9+4 more2019-09-27

CVE-2019-4141 [MEDIUM] CWE-401 CVE-2019-4141: IBM MQ 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.9, 8.0.0.0 - 8.0.0.11, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0. IBM MQ 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.9, 8.0.0.0 - 8.0.0.11, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.1 - 9.1.2 is vulnerable to a denial of service attack caused by a memory leak in the clustering code. IBM X-Force ID: 158337.

nvd

CVE-2019-4261MEDIUMCVSS 6.5≥ 7.1.0.0, ≤ 7.1.0.9≥ 7.5, ≤ 7.5.0.92019-08-05

CVE-2019-4261 [MEDIUM] CVE-2019-4261: IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulne IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. IBM X-Force ID: 160013.

nvd

CVE-2019-4078HIGHCVSS 7.8≥ 8.0.0.0, ≤ 8.0.0.11≥ 9.0.0.0, ≤ 9.0.0.5+2 more2019-05-23

CVE-2019-4078 [HIGH] CWE-732 CVE-2019-4078: IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privilege IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on MQ installation directories. IBM X-Force ID: 157190.

nvd

CVE-2019-4039MEDIUMCVSS 5.5≥ 8.0.0.0, ≤ 8.0.0.11≥ 9.0.0.0, ≤ 9.0.0.5+2 more2019-05-23

CVE-2019-4039 [MEDIUM] CVE-2019-4039: IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local attacker to c IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local attacker to cause a denial of service within the error log reporting system. IBM X-Force ID: 156163.

nvd

CVE-2018-1925MEDIUMCVSS 5.9≥ 9.1.0.0, ≤ 9.1.0.1v9.1.12019-04-15

CVE-2018-1925 [MEDIUM] CWE-326 CVE-2018-1925: IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that coul IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 152925.

nvd

CVE-2018-1974HIGHCVSS 7.5≥ 8.0.0.0, ≤ 8.0.0.10≥ 9.0.0.0, ≤ 9.0.0.5+1 more2019-03-11

CVE-2018-1974 [HIGH] CVE-2018-1974: IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileg IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels. IBM X-Force ID: 153915.

nvd

CVE-2018-1998HIGHCVSS 7.8≥ 8.0.0.0, ≤ 8.0.0.10≥ 9.0.0.0, ≤ 9.0.0.5+1 more2019-03-11

CVE-2018-1998 [HIGH] CVE-2018-1998: IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be execute IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges. This is due to an incomplete fix for CVE-2018-1792. IBM X-ForceID: 154887.

nvd

CVE-2018-1792HIGHCVSS 7.8≥ 8.0.0.0, ≤ 8.0.0.10≥ 9.0.0.0, ≤ 9.0.0.5+2 more2018-11-13

CVE-2018-1792 [HIGH] CWE-94 CVE-2018-1792: IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0 IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0 could allow a local user to inject code that could be executed with root privileges. IBM X-Force ID: 148947.

nvd

CVE-2018-1684MEDIUMCVSS 6.5≥ 8.0.0.0, ≤ 8.0.0.10≥ 9.0.0.0, ≤ 9.0.0.5+2 more2018-11-09

CVE-2018-1684 [MEDIUM] CVE-2018-1684: IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack. IBM X-Force ID: 145456.

nvd

CVE-2018-1551HIGHCVSS 7.5≥ 8.0.0.2, ≤ 8.0.0.8≥ 9.0.0.0, ≤ 9.0.0.3+11 more2018-08-06

CVE-2018-1551 [LOW] CWE-732 CVE-2018-1551: IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator creates an invalid user group name. IBM X-Force ID: 142888.

cvelistv5nvd

CVE-2018-1503MEDIUMCVSS 4.3≥ 7.5.0.0, ≤ 7.5.0.8≥ 8.0.0.0, ≤ 8.0.0.9+4 more2018-07-23

CVE-2018-1503 [MEDIUM] CWE-20 CVE-2018-1503: IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a remotely authenticated attacker to to send invalid IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a remotely authenticated attacker to to send invalid or malformed headers that could cause messages to no longer be transmitted via the affected channel. IBM X-Force ID: 141339.

cvelistv5nvd

CVE-2017-1795MEDIUMCVSS 4.4v7.5v8.0+5 more2018-07-06

CVE-2017-1795 [MEDIUM] CWE-532 CVE-2017-1795: IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSphere MQ Managed File Transfer. IBM X-Force ID: 137042.

cvelistv5nvd

1 / 5Next →