IBM WebSphere Mq vulnerabilities

89 CVEs affecting IBM WebSphere Mq, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-2201, published 2022-09-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4682, published 2021-01-28. Critical severity, CVSS 9.8. EPSS: 7.2% chance of exploitation in the next 30 days. IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit…
CVE-2009-0896, published 2009-06-03. High severity, CVSS 10.0. EPSS: 6.7% chance of exploitation in the next 30 days. Buffer overflow in the queue manager in IBM WebSphere MQ 6.x before 6.0.2.7 and 7.x before 7.0.1.0 allows remote attackers to execute arbitrary code via a crafted request.
CVE-2011-0310, published 2011-01-13. Medium severity, CVSS 6.8. EPSS: 3% chance of exploitation in the next 30 days. Buffer overflow in IBM WebSphere MQ 7.0 before 7.0.1.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted header field in a message.
CVE-2011-0314, published 2011-01-12. Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days. Heap-based buffer overflow in IBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 allows remote authenticated users to execute arbitrary code or cause a denial of service (queue manager…
CVE-2009-3159, published 2009-09-10. High severity, CVSS 7.8. EPSS: 2.5% chance of exploitation in the next 30 days. Unspecified vulnerability in the rriDecompress function in IBM WebSphere MQ 7.0.0.0, 7.0.0.1, and 7.0.0.2 allows remote attackers to cause a denial of service via unknown vectors.
CVE-2015-2013, published 2015-09-14. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers to cause a denial of service (channel-agent abend and process outage) via a crafted selection string in an MQI call.
CVE-2019-4261, published 2019-08-05. Medium severity, CVSS 6.5. EPSS: 2.4% chance of exploitation in the next 30 days. IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. IBM X-Force ID: 160013.
CVE-2013-4054, published 2014-03-02. Medium severity, CVSS 4.3. EPSS: 2.3% chance of exploitation in the next 30 days. Directory traversal vulnerability in WMQ Telemetry in IBM WebSphere MQ 7.5 before 7.5.0.3 allows remote attackers to read arbitrary files via a crafted URI.
CVE-2017-1235, published 2017-09-25. Medium severity, CVSS 6.5. EPSS: 2.3% chance of exploitation in the next 30 days. IBM WebSphere MQ 8.0 could allow an authenticated user to cause a premature termination of a client application thread which could potentially cause denial of service. IBM X-Force ID: 123914.
CVE-2018-1388, published 2018-02-07. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. GSKit V7 may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding. IBM X-Force ID: 138212.

Latest

CVE-2012-2201, published 2022-09-29. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. IBM WebSphere MQ 7.1 is vulnerable to a denial of service, caused by an error when handling user ids. A remote attacker could exploit this vulnerability to bypass the security configuration setup on…
CVE-2021-38949, published 2021-11-16. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403.
CVE-2020-4310, published 2020-06-16. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic. IBM X-Force ID: 177081.
CVE-2019-4719, published 2020-03-16. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data.
CVE-2019-4656, published 2020-03-16. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to crash the queue and require a restart due…
CVE-2019-4619, published 2020-03-16. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. IBM X-Force ID:…
CVE-2012-4863, published 2020-01-23. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability
CVE-2019-4141, published 2019-09-27. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. IBM MQ 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.9, 8.0.0.0 - 8.0.0.11, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.1 - 9.1.2 is vulnerable to a denial of service attack caused by a memory leak in the…