Known vulnerabilities in IBM Business Automation Workflow 25.0.0-IF004
Vendor:
IBM Corporation
Software:
IBM Business Automation Workflow
Version:
25.0.0-IF004
Software CPE:
cpe:2.3:a:ibm_corporation:ibm_business_automation_workflow:*:*:*:*:*:*:*:*
Website:
https://www.ibm.com/us-en
Total vulnerabilities:
53
Public exploits:
1
Known exploited (KEV):
0
Highest CVSSv4 Score:
9.3
Vulnerabilities by Severity
25.0.0-IF004
24.0.0-IF009
24.0.1-IF008
25.0.0-IF005
26.0.0.0
25.0.1
24.0.0-IF008
24.0.1-IF007
25.0.0-IF003
24.0.1-IF006
24.0.1-IF003
24.0.0-IF007
25.0.0-IF002
25.0.0-IF001
24.0.1-IF005
24.0.1-IF004
24.0.0-IF006
25.0.0.0
24.0.0-IF005
24.0.1-IF002
24.0.1-IF001
21.0.3-IF039
24.0.0-IF004
21.0.2-IF011
21.0.3-IF010
24.0.1.0
21.0.3-IF037
24.0.0-IF003
24.0.0-IF002
24.0.0
21.0.3-IF035
21.0.3-IF034
23.0.2-IF006
24.0.0-IF001
21.0.3 IF034
23.0.2 IF006
21.0.3 IF033
23.0.2 IF005
21.0.3 IF031
23.0.2 IF003
21.0.3 IF028
23.0.1 IF006
21.0.3 IF030
23.0.2 IF002
21.0.3 IF022
22.0.2 IF006
21.0.3 IF026
23.0.1 IF004
23.0.2 IF001
21.0.3 IF029
23.0.2
21.0.3 IF025
23.0.1 IF003
23.0.1 IF005
21.0.3 IF027
21.0.3 IF024
23.0.1 IF002
21.0.3 IF023
23.0.1 IF001
23.0.1
21.0.3 IF021
22.0.2 IF005
21.0.3 IF020
22.0.2 IF004
21.0.3 IF019
22.0.2 IF003
21.0.3 IF018
21.0.3 IF017
22.0.2 IF002
22.0.2 IF001
21.0.3 IF016
22.0.1 IF006
-
22.0.2
21.0.3 IF015
22.0.1 IF005
22.0.1 IF003
21.0.3 IF014
22.0.1 IF004
21.0.3-IF012
21.0.3-IF011
22.0.1-IF002
22.0.1-IF001
18.0.0.2
22.0.1
18.0.0.1
18.0.0.0
19.0.0.3
19.0.0.2
19.0.0.1
20.0.0.2
20.0.0.1
21.0.3
21.0.2
21.0.1
18.0
19.0
20.0
21.0
Vulnerabilities (53)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU140607 - Time-of-check Time-of-use (TOCTOU) Race Condition CVE-2026-32282 |
CWE-367 | Low | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 31.07.2026 |
SB2026073125 SB2026073160 SB2026073161 and 50 more |
||
| #VU140606 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-32289 |
CWE-79 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 31.07.2026 |
SB2026073125 SB20260731139 SB20260731140 and 4 more |
||
| #VU140605 - Improper Certificate Validation CVE-2026-33810 |
CWE-295 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 31.07.2026 |
SB2026073125 SB2026073183 SB2026073184 and 7 more |
||
| #VU140602 - Allocation of Resources Without Limits or Throttling CVE-2026-32288 |
CWE-770 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 31.07.2026 |
SB2026073125 SB2026073155 SB2026073156 and 9 more |
||
| #VU140600 - Improper input validation CVE-2026-32281 |
CWE-20 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 31.07.2026 |
SB2026073125 SB2026073183 SB2026073184 and 35 more |
||
| #VU140599 - Resource exhaustion CVE-2026-32280 |
CWE-400 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 31.07.2026 |
SB2026073125 SB2026073160 SB2026073161 and 70 more |
||
| #VU138768 - Allocation of Resources Without Limits or Throttling CVE-2026-35469 |
CWE-770 | Low | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 20.07.2026 |
SB20260720353 SB20260720355 SB20260720356 and 41 more |
||
| #VU136680 - Dependency on Vulnerable Third-Party Component CVE-2026-32283 |
CWE-1395 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 02.07.2026 |
SB2026070218 SB2026070239 SB2026070240 and 61 more |
||
| #VU125804 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\') CVE-2026-2950 |
CWE-1321 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 10.04.2026 |
SB2026041094 SB2026042049 SB2026042720 and 14 more |
||
| #VU125803 - Improper Control of Generation of Code ('Code Injection') CVE-2026-4800 |
CWE-94 | High | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 10.04.2026 |
SB2026041094 SB20260410101 SB20260410102 and 59 more |
||
| #VU125750 - Server-Side Request Forgery (SSRF) CVE-2025-62718 |
CWE-918 | High | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 10.04.2026 |
SB2026041001 SB2026050419 SB2026050715 and 29 more |
||
| #VU124825 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\') CVE-2026-29063 |
CWE-1321 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 02.04.2026 |
SB2026040246 SB2026040612 SB2026040627 and 32 more |
||
| #VU124034 - Resource exhaustion CVE-2025-61726 |
CWE-400 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 16.03.2026 |
SB2026031636 SB2026031637 SB2026031638 and 143 more |
||
| #VU124033 - Improper input validation CVE-2025-61728 |
CWE-20 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 16.03.2026 |
SB2026031636 SB2026031637 SB2026031638 and 46 more |
||
| #VU122779 - Memory corruption CVE-2026-2006 |
CWE-119 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 12.02.2026 |
SB2026021258 SB2026021302 SB2026021303 and 69 more |
||
| #VU122778 - Heap-based Buffer Overflow CVE-2026-2005 |
CWE-122 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 12.02.2026 |
SB2026021258 SB2026021302 SB2026021303 and 60 more |
||
| #VU122777 - Type confusion CVE-2026-2004 |
CWE-843 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 12.02.2026 |
SB2026021258 SB2026021302 SB2026021303 and 60 more |
||
| #VU122776 - Out-of-bounds read CVE-2026-2003 |
CWE-125 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 12.02.2026 |
SB2026021258 SB2026021302 SB2026021303 and 39 more |
||
| #VU121928 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\') CVE-2025-13465 |
CWE-1321 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 22.01.2026 |
SB2026012209 SB2026012701 SB2026012744 and 69 more |
||
| #VU53202 - Command injection CVE-2021-23337 |
CWE-77 | Medium | 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0 | 12.05.2021 |
SB2021021525 SB2021051230 SB2021062703 and 59 more |
Showing elements 1 - 20 out of 53