Ibm Websphere Message Broker — known CVE vulnerabilities

Every CVE whose affected-product data names Ibm Websphere Message Broker, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (23)

• CVE-2016-9706 — CVSS 9.1 (critical): IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External…
• CVE-2012-3317 — CVSS 6.9 (medium): IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller…
• CVE-2016-9010 — CVSS 6.1 (medium): IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim…
• CVE-2017-1207 — CVSS 5.5 (medium): IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777.
• CVE-2017-1126 — CVSS 5.3 (medium): IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about…
• CVE-2018-1801 — CVSS 5.3 (medium): IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through…
• CVE-2015-7399 — CVSS 5.3 (medium): IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow…
• CVE-2016-2961 — CVSS 5.3 (medium): The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows…
• CVE-2016-6080 — CVSS 5.3 (medium): The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker.
• CVE-2012-5952 — CVSS 5.0 (medium): IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2 does not validate Basic Authentication…
• CVE-2014-6170 — CVSS 5.0 (medium): The HTTPInput node in IBM WebSphere Message Broker 7.0 before 7.0.0.8 and 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.4…
• CVE-2012-5953 — CVSS 4.3 (medium): IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2, when the Parse Query Strings option is…
• CVE-2013-0482 — CVSS 4.3 (medium): IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1…
• CVE-2015-0118 — CVSS 4.3 (medium): IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with…
• CVE-2013-5372 — CVSS 4.3 (medium): The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus…
• CVE-2017-1418 — CVSS 4.0 (medium): IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0.9) has insecure…
• CVE-2014-4819 — CVSS 4.0 (medium): The web user interface in IBM WebSphere Message Broker 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.3 allows remote…
• CVE-2015-2018 — CVSS 3.5 (low): IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the…
• CVE-2016-0394 — CVSS 3.3 (low): IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate…
• CVE-2015-5011 — CVSS 3.2 (low): IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and…
• CVE-2013-0466 — CVSS 2.6 (low): Cross-site scripting (XSS) vulnerability in IBM WebSphere Message Broker 7.0 before 7.0.0.6 and 8.0 before 8.0.0.2, when wsdl support is…
• CVE-2017-1144 — CVSS 2.5 (low): IBM WebSphere Message Broker could allow a local user with specialized access to prevent the message broker from starting. IBM X-Force ID…
• CVE-2009-0503 — CVSS 2.1 (low): IBM WebSphere Message Broker 6.1.x before 6.1.0.2 writes a database connection password to the Event Log and System Log during exception…