Ibm Websphere Mq vulnerabilities
91 known vulnerabilities affecting ibm/websphere_mq.
Total CVEs
91
CISA KEV
0
Public exploits
2
Exploited in wild
0
Severity breakdown
CRITICAL3HIGH18MEDIUM58LOW12
Vulnerabilities
Page 1 of 5
CVE-2020-4682P2CRITICALCVSS 9.8v7.5.0.0v7.5.0.1+8 more2021-01-28
CVE-2020-4682 [CRITICAL] CWE-502 CVE-2020-4682: IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary co
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.
nvd
CVE-2009-0896P3CRITICALCVSS 10.0v6.0v6.0.0.0+12 more2009-06-03
CVE-2009-0896 [CRITICAL] CWE-119 CVE-2009-0896: Buffer overflow in the queue manager in IBM WebSphere MQ 6.x before 6.0.2.7 and 7.x before 7.0.1.0 a
Buffer overflow in the queue manager in IBM WebSphere MQ 6.x before 6.0.2.7 and 7.x before 7.0.1.0 allows remote attackers to execute arbitrary code via a crafted request.
nvd
CVE-2012-3294P4MEDIUMCVSS 6.8PoC≤ 7.0.4v7.0+5 more2012-08-17
CVE-2012-3294 [MEDIUM] CWE-352 CVE-2012-3294: Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSp
Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier, and WebSphere MQ - Managed File Transfer 7.5, allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add user accounts via the /wmqfteconsole/Filespaces URI, (2) modi
nvd
CVE-2012-2206P4LOWCVSS 3.5PoCv7.0v7.0.0.1+5 more2012-08-17
CVE-2012-2206 [LOW] CWE-264 CVE-2012-2206: The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI.
nvd
CVE-2012-2201P3HIGHCVSS 7.5v7.12022-09-29
CVE-2012-2201 [HIGH] CVE-2012-2201: IBM WebSphere MQ 7.1 is vulnerable to a denial of service, caused by an error when handling user ids
IBM WebSphere MQ 7.1 is vulnerable to a denial of service, caused by an error when handling user ids. A remote attacker could exploit this vulnerability to bypass the security configuration setup on a SVRCONN channel and flood the queue manager.
nvd
CVE-2018-1974P3HIGHCVSS 7.5≥ 8.0.0.0, ≤ 8.0.0.10≥ 9.0.0.0, ≤ 9.0.0.5+1 more2019-03-11
CVE-2018-1974 [HIGH] CVE-2018-1974: IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileg
IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels. IBM X-Force ID: 153915.
nvd
CVE-2017-1337P3HIGHCVSS 8.1v9.0.1v9.0.22017-07-10
CVE-2017-1337 [HIGH] CWE-522 CVE-2017-1337: IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in p
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. IBM X-Force ID: 126245.
nvd
CVE-2017-1118P3HIGHCVSS 7.5v2.1v2.02017-08-02
CVE-2017-1118 [HIGH] CVE-2017-1118: IBM WebSphere MQ Internet Pass-Thru 2.0 and 2.1 could allow n attacker to cause the MQIPT to stop re
IBM WebSphere MQ Internet Pass-Thru 2.0 and 2.1 could allow n attacker to cause the MQIPT to stop responding due to an incorrectly configured security policy. IBM X-Force ID: 121156.
nvd
CVE-2018-1388P3HIGHCVSS 7.5v7.0.1.0v7.0.1.1+14 more2018-02-07
CVE-2018-1388 [HIGH] CWE-200 CVE-2018-1388: GSKit V7 may disclose side channel information via discrepancies between valid and invalid PKCS#1 pa
GSKit V7 may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding. IBM X-Force ID: 138212.
nvd
CVE-2018-1792P3HIGHCVSS 7.8≥ 8.0.0.0, ≤ 8.0.0.10≥ 9.0.0.0, ≤ 9.0.0.5+2 more2018-11-13
CVE-2018-1792 [HIGH] CWE-94 CVE-2018-1792: IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0
IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0 could allow a local user to inject code that could be executed with root privileges. IBM X-Force ID: 148947.
nvd
CVE-2017-1145P3HIGHCVSS 8.6v8.0.0.62017-03-20
CVE-2017-1145 [HIGH] CWE-404 CVE-2017-1145: IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed,
IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource exhaustion. IBM Reference #: 1999672.
nvd
CVE-2018-1998P3HIGHCVSS 7.8≥ 8.0.0.0, ≤ 8.0.0.10≥ 9.0.0.0, ≤ 9.0.0.5+1 more2019-03-11
CVE-2018-1998 [HIGH] CVE-2018-1998: IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be execute
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges. This is due to an incomplete fix for CVE-2018-1792. IBM X-ForceID: 154887.
nvd
CVE-2019-4078P3HIGHCVSS 7.8≥ 8.0.0.0, ≤ 8.0.0.11≥ 9.0.0.0, ≤ 9.0.0.5+2 more2019-05-23
CVE-2019-4078 [HIGH] CWE-732 CVE-2019-4078: IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privilege
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on MQ installation directories. IBM X-Force ID: 157190.
nvd
CVE-2018-1551P3HIGHCVSS 7.5≥ 8.0.0.2, ≤ 8.0.0.8≥ 9.0.0.0, ≤ 9.0.0.3+11 more2018-08-06
CVE-2018-1551 [HIGH] CWE-732 CVE-2018-1551: IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more
IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator creates an invalid user group name. IBM X-Force ID: 142888.
nvd
CVE-2017-1612P3HIGHCVSS 7.8v7.5v7.5.0.1+44 more2018-01-09
CVE-2017-1612 [HIGH] CVE-2017-1612: IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted
IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953.
nvd
CVE-2011-0314P3MEDIUMCVSS 6.5v6.0v6.0.1.0+21 more2011-01-12
CVE-2011-0314 [MEDIUM] CWE-119 CVE-2011-0314: Heap-based buffer overflow in IBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 allows rem
Heap-based buffer overflow in IBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 allows remote authenticated users to execute arbitrary code or cause a denial of service (queue manager crash) by inserting an invalid message into the queue.
nvd
CVE-2020-4310P4HIGHCVSS 7.5v7.1v7.52020-06-16
CVE-2020-4310 [HIGH] CVE-2020-4310: IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of ser
IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic. IBM X-Force ID: 177081.
nvd
CVE-2011-0310P4MEDIUMCVSS 6.8v7.0v7.0.0.1+5 more2011-01-13
CVE-2011-0310 [MEDIUM] CWE-119 CVE-2011-0310: Buffer overflow in IBM WebSphere MQ 7.0 before 7.0.1.4 allows remote attackers to execute arbitrary
Buffer overflow in IBM WebSphere MQ 7.0 before 7.0.1.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted header field in a message.
nvd
CVE-2016-0260P4HIGHCVSS 7.5v8.0v8.0.0.1+3 more2016-06-29
CVE-2016-0260 [HIGH] CWE-399 CVE-2016-0260: Memory leak in queue-manager agents in IBM WebSphere MQ 8.x before 8.0.0.5 allows remote attackers t
Memory leak in queue-manager agents in IBM WebSphere MQ 8.x before 8.0.0.5 allows remote attackers to cause a denial of service (heap memory consumption) by triggering many errors.
nvd
CVE-2019-4261P4MEDIUMCVSS 6.5≥ 7.1.0.0, ≤ 7.1.0.9≥ 7.5, ≤ 7.5.0.92019-08-05
CVE-2019-4261 [MEDIUM] CVE-2019-4261: IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulne
IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. IBM X-Force ID: 160013.
nvd
1 / 5Next →