Known vulnerabilities in IBM Business Automation Workflow 24.0.1-IF002
Vendor:
IBM Corporation
Software:
IBM Business Automation Workflow
Version:
24.0.1-IF002
Software CPE:
cpe:2.3:a:ibm_corporation:ibm_business_automation_workflow:*:*:*:*:*:*:*:*
Website:
https://www.ibm.com/us-en
Total vulnerabilities:
105
Public exploits:
7
Known exploited (KEV):
0
Highest CVSSv4 Score:
9.3
Vulnerabilities by Severity
25.0.0-IF004
24.0.0-IF009
24.0.1-IF008
25.0.0-IF005
26.0.0.0
25.0.1
24.0.0-IF008
24.0.1-IF007
25.0.0-IF003
24.0.1-IF006
24.0.1-IF003
24.0.0-IF007
25.0.0-IF002
25.0.0-IF001
24.0.1-IF005
24.0.1-IF004
24.0.0-IF006
25.0.0.0
24.0.0-IF005
24.0.1-IF002
24.0.1-IF001
21.0.3-IF039
24.0.0-IF004
21.0.2-IF011
21.0.3-IF010
24.0.1.0
21.0.3-IF037
24.0.0-IF003
24.0.0-IF002
24.0.0
21.0.3-IF035
21.0.3-IF034
23.0.2-IF006
24.0.0-IF001
21.0.3 IF034
23.0.2 IF006
21.0.3 IF033
23.0.2 IF005
21.0.3 IF031
23.0.2 IF003
21.0.3 IF028
23.0.1 IF006
21.0.3 IF030
23.0.2 IF002
21.0.3 IF022
22.0.2 IF006
21.0.3 IF026
23.0.1 IF004
23.0.2 IF001
21.0.3 IF029
23.0.2
21.0.3 IF025
23.0.1 IF003
23.0.1 IF005
21.0.3 IF027
21.0.3 IF024
23.0.1 IF002
21.0.3 IF023
23.0.1 IF001
23.0.1
21.0.3 IF021
22.0.2 IF005
21.0.3 IF020
22.0.2 IF004
21.0.3 IF019
22.0.2 IF003
21.0.3 IF018
21.0.3 IF017
22.0.2 IF002
22.0.2 IF001
21.0.3 IF016
22.0.1 IF006
-
22.0.2
21.0.3 IF015
22.0.1 IF005
22.0.1 IF003
21.0.3 IF014
22.0.1 IF004
21.0.3-IF012
21.0.3-IF011
22.0.1-IF002
22.0.1-IF001
18.0.0.2
22.0.1
18.0.0.1
18.0.0.0
19.0.0.3
19.0.0.2
19.0.0.1
20.0.0.2
20.0.0.1
21.0.3
21.0.2
21.0.1
18.0
19.0
20.0
21.0
Vulnerabilities (105)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU132004 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CVE-2026-35554 |
CWE-362 | High | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 21.05.2026 |
SB2026052106 SB2026052107 SB2026052541 and 8 more |
||
| #VU131921 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') CVE-2026-40175 |
CWE-113 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 20.05.2026 |
SB2026052045 SB2026052051 SB2026052052 and 21 more |
||
| #VU124829 - Exposure of sensitive information to an unauthorized actor CVE-2025-14915 |
CWE-200 | Low | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 02.04.2026 |
SB2026040252 SB2026040326 SB2026040329 and 15 more |
||
| #VU124817 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CVE-2026-27148 |
CWE-74 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 02.04.2026 |
SB2026040224 SB2026040225 SB20260825138 |
||
| #VU124546 - Missing release of memory after effective lifetime CVE-2026-21714 |
CWE-401 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 25.03.2026 |
SB20260325154 SB2026032902 SB20260415182 and 20 more |
||
| #VU124547 - Creation of chroot Jail Without Changing Working Directory CVE-2026-21717 |
CWE-243 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 25.03.2026 |
SB20260325154 SB2026032902 SB20260415182 and 17 more |
||
| #VU124548 - Improper Access Control CVE-2026-21715 |
CWE-284 | Low | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 25.03.2026 |
SB20260325154 SB2026032902 SB2026041564 and 18 more |
||
| #VU124549 - Improper Access Control CVE-2026-21716 |
CWE-284 | Low | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 25.03.2026 |
SB20260325154 SB2026032902 SB20260415182 and 18 more |
||
| #VU124541 - DEPRECATED: Often Misused: Path Manipulation CVE-2026-21637 |
CWE-249 | High | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 25.03.2026 |
SB2026032902 SB20260415182 SB20260415187 and 26 more |
||
| #VU124542 - Error Handling CVE-2026-21710 |
CWE-388 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 25.03.2026 |
SB20260325154 SB2026032902 SB2026041056 and 29 more |
||
| #VU124543 - Improper Access Control CVE-2026-21711 |
CWE-284 | Low | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 25.03.2026 |
SB20260325154 SB20260424153 SB20260424154 and 1 more |
||
| #VU124544 - Reachable Assertion CVE-2026-21712 |
CWE-617 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 25.03.2026 |
SB20260325154 SB2026041725 SB20260424153 and 2 more |
||
| #VU124545 - Information Exposure Through Timing Discrepancy CVE-2026-21713 |
CWE-208 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 25.03.2026 |
SB20260325154 SB2026032902 SB2026041543 and 19 more |
||
| #VU123997 - Improper input validation CVE-2026-2391 |
CWE-20 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 13.03.2026 |
SB2026031335 SB2026031336 SB2026032417 and 13 more |
||
| #VU122489 - Heap-based Buffer Overflow CVE-2026-25646 |
CWE-122 | High | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 10.02.2026 |
SB2026021002 SB2026021255 SB2026021256 and 64 more |
||
| #VU121184 - Out-of-bounds read CVE-2026-22801 |
CWE-125 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 13.01.2026 |
SB2026011311 SB20260114154 SB2026012271 and 24 more |
||
| #VU121159 - Resource exhaustion CVE-2025-15284 |
CWE-400 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 12.01.2026 |
SB2026011229 SB2026011326 SB2026011926 and 38 more |
||
| #VU120348 - Out-of-bounds read CVE-2025-10158 |
CWE-125 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 26.12.2025 |
SB2025122689 SB2025122697 SB2025122698 and 27 more |
||
| #VU120231 - Improper Validation of Certificate with Host Mismatch CVE-2025-68161 |
CWE-297 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 22.12.2025 |
SB2025122245 SB2026012084 SB2026012087 and 101 more |
||
| #VU118777 - Heap-based Buffer Overflow CVE-2025-65018 |
CWE-122 | Critical | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 26.11.2025 |
SB2025112638 SB2025112639 SB2025112819 and 46 more |
Showing elements 1 - 20 out of 105