IBM Vulnerabilities and Affected Products
Vulnerabilities associated with Security Verify Access Docker.
Products
Clear product- Db2 for Linux, UNIX and Windows168 vulnerabilities
- i162 vulnerabilities
- WebSphere Application Server152 vulnerabilities
- InfoSphere Information Server146 vulnerabilities
- Sterling B2B Integrator132 vulnerabilities
- Rational Quality Manager126 vulnerabilities
- Rational Collaborative Lifecycle Management114 vulnerabilities
- Security Guardium106 vulnerabilities
- QRadar SIEM100 vulnerabilities
- Cognos Analytics98 vulnerabilities
- Rational DOORS Next Generation91 vulnerabilities
- MQ83 vulnerabilities
- Maximo Asset Management81 vulnerabilities
- API Connect78 vulnerabilities
- Rational Engineering Lifecycle Manager76 vulnerabilities
- Rational Team Concert72 vulnerabilities
- AIX69 vulnerabilities
- Langflow OSS68 vulnerabilities
- Sterling File Gateway64 vulnerabilities
- Security Key Lifecycle Manager57 vulnerabilities
- Security Verify Access57 vulnerabilities
- Cloud Pak for Security55 vulnerabilities
- Cognos Controller52 vulnerabilities
- Engineering Lifecycle Optimization52 vulnerabilities
- Spectrum Protect Plus49 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-36354HIGH | IBM Security Verify Access command executionIBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow an unauthenticated user to execute arbitrary commands with lower user privileges on the system due to improper validation of user supplied input. CWE-78Oct 6, 2025 | CVSS7.3v3.1 | EPSS0.295% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-36355HIGH | IBM Security Verify Access code executionIBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere. CWE-829Oct 6, 2025 | CVSS8.5v3.1 | EPSS0.155% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-36356CRITICAL | IBM Security Verify Access privilege escalationIBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to escalate their privileges to root due to execution with more privileges than required. CWE-250Oct 6, 2025 | CVSS9.3v3.1 | EPSS0.176% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0163MEDIUM | IBM Security Verify Access information disclosureIBM Security Verify Access Appliance and Docker 10.0 through 10.0.8 could allow a remote attacker to enumerate usernames due to an observable response discrepancy of disabled accounts. CWE-204Jun 11, 2025 | CVSS5.3v3.1 | EPSS0.294% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-45647MEDIUM | IBM Security Verify Access unverified password changeIBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password. CWE-620Jan 20, 2025 | CVSS5.6v3.1 | EPSS0.264% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-35141HIGH | IBM Security Verify Access privilege escalationIBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges. CWE-250Dec 19, 2024 | CVSS7.8v3.1 | EPSS0.228% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-35133MEDIUM | IBM Security Verify Access HTTP open redirectIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. CWE-601Aug 29, 2024 | CVSS6.8v3.1 | EPSS1.77% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-35139MEDIUM | IBM Security Access Manager Docker information disclosureIBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from the container due to incorrect default permissions. IBM X-Force ID: 292415. CWE-276Jun 28, 2024 | CVSS6.2v3.1 | EPSS0.232% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-35137MEDIUM | IBM Security Access Manager Docker information disclosureIBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 292413. | CVSS6.2v3.1 | EPSS0.255% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-35142HIGH | IBM Security Verify Access privilege escalationIBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges. IBM X-Force ID: 292418. CWE-250May 31, 2024 | CVSS8.4v3.1 | EPSS0.229% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-35140HIGH | IBM Security Verify Access privilege escalationIBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to improper certificate validation. IBM X-Force ID: 292416. CWE-295May 31, 2024 | CVSS7.7v3.1 | EPSS0.126% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-25027MEDIUM | IBM Security Verify Access Container information disclosureIBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption. IBM X-Force ID: 281607. CWE-311Mar 31, 2024 | CVSS6.2v3.1 | EPSS0.107% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-38369MEDIUM | IBM Security Access Manager Container information disclosureIBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196. CWE-521Feb 7, 2024 | CVSS6.2v3.1 | EPSS0.532% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-31002MEDIUM | IBM Security Access Manager Container information disclosureIBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254657. | CVSS5.1v3.1 | EPSS0.125% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-43017HIGH | IBM Security Verify Access man in the middleIBM Security Verify Access 10.0.0.0 through 10.0.6.1 could allow a privileged user to install a configuration file that could allow remote access. IBM X-Force ID: 266155. CWE-295Feb 7, 2024 | CVSS8.2v3.1 | EPSS0.555% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32330HIGH | IBM Security Verify Access man in the middleIBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure calls that could allow an attacker on the network to take control of the server. IBM X-Force ID: 254977. CWE-295Feb 7, 2024 | CVSS7.5v3.1 | EPSS0.86% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32328HIGH | IBM Security Verify Access information disclosureIBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of the server. IBM X-Force Id: 254957. CWE-319Feb 7, 2024 | CVSS7.5v3.1 | EPSS0.577% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-31006MEDIUM | IBM Security Access Manager Container denial of serviceIBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to a denial of service attacks on the DSC server. IBM X-Force ID: 254776. CWE-400Feb 3, 2024 | CVSS6.5v3.1 | EPSS0.892% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-31004HIGH | IBM Security Access Manager Container gain accessIBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote attacker to gain access to the underlying system using man in the middle techniques. IBM X-Force ID: 254765. CWE-300Feb 3, 2024 | CVSS8.3v3.1 | EPSS0.988% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32329MEDIUM | IBM Security Access Manager Container improper file validationIBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a user to download files from an incorrect repository due to improper file validation. IBM X-Force ID: 254972. CWE-345Feb 3, 2024 | CVSS6.2v3.1 | EPSS0.155% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32327HIGH | IBM Security Access Manager Container XML external entity injectionIBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 254783. CWE-611Feb 3, 2024 | CVSS7.1v3.1 | EPSS0.963% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-43016HIGH | IBM Security Access Manager Container unauthorized accessIBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log into the server due to a user account with an empty password. IBM X-Force ID: 266154. | CVSS7.3v3.1 | EPSS0.713% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-30999HIGH | IBM Security Access Manager denial of serviceIBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow an attacker to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 254651. CWE-400Feb 3, 2024 | CVSS7.5v3.1 | EPSS1.03% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-31005MEDIUM | IBM Security Access Manager Container privilege escalationIBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a local user to escalate their privileges due to an improper security configuration. IBM X-Force ID: 254767. CWE-269Feb 3, 2024 | CVSS6.2v3.1 | EPSS0.228% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-38267MEDIUM | IBM Security Access Manager Appliance information disclosureIBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 260584. CWE-311Jan 11, 2024 | CVSS6.2v3.1 | EPSS0.148% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |