webMethods Integration vulnerabilities
7 known vulnerabilities in webMethods Integration from IBM. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
webMethods Integration (on prem): Deserialization of Untrusted Data
IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
- 8.8 High severity
webMethods Integration: Deserialization of Untrusted Data
IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fix6 IBM webMethods Integration allow an authenticated user to execute arbitrary code on the system, caused by the deserialization of untruste
- 8.8 High severity
webMethods Integration: Use of Externally-Controlled Format String
IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings passed as an argument from an external source.
- 8.8 High severity
webMethods Integration Server: Improper Restriction of XML External Entity Reference
IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands.
- 7.2 High severity
webMethods Integration Server: Execution with Unnecessary Privileges
IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due to execution with unnecessary privileges.
- 9.9 Critical severity
webMethods Integration: Unrestricted Upload of File with Dangerous Type
IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating system.
- 8.8 High severity
webMethods Integration: Missing Authentication for Critical Functionality
IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administrator due to missing authentication.