IBM Business Automation Workflow

Name: IBM Business Automation Workflow
Brand: IBM

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical7high50medium0low

updated 2026-10-27

vulnerabilities (95)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-5878US	—	0.50% (42nd)	Exploit	24.0.1-IF006	2025-06-29	3 versions
CVE-2025-22870US	—	0.43% (37th)	Exploit	24.0.0-IF005	2025-03-12	2 versions
CVE-2019-4424US	high8.2	2.43% (84th)	—	no fix	2019-08-20	5 versions
CVE-2018-1885US	medium5.3	1.81% (78th)	—	no fix	2019-04-08	3 versions
CVE-2024-24762US	high7.5	1.52% (74th)	—	23.0.2-IF003	2024-02-05	< 23.0.2-IF003
CVE-2023-33008US	medium5.3	1.44% (73rd)	—	23.0.2-IF003	2023-07-07	2 versions
CVE-2020-4531US	medium5.3	1.43% (73rd)	—	no fix	2020-09-25	3 versions
CVE-2018-1997US	medium6.5	1.36% (72nd)	—	no fix	2019-04-08	3 versions
CVE-2018-1848US	medium6.1	1.32% (71st)	—	no fix	2018-12-14	2 versions
CVE-2020-14338US	medium5.3	1.29% (70th)	—	23.0.2	2020-09-17	< 23.0.2
CVE-2024-31141US	—	1.24% (69th)	—	24.0.1-IF001	2024-11-19	2 versions
CVE-2021-38900US	medium6.5	1.17% (67th)	—	no fix	2021-12-21	9 versions
CVE-2019-4425US	medium5.7	1.16% (67th)	—	no fix	2019-08-20	3 versions
CVE-2024-21217US	—	1.15% (67th)	—	24.0.0-IF005	2024-10-15	2 versions
CVE-2024-34156US	—	1.13% (66th)	—	24.0.1-IF002	2024-09-06	2 versions
CVE-2020-36732US	medium5.3OT elevated	1.07% (65th)	—	24.0.1-IF006	2023-06-12	3 versions
CVE-2023-42950US	high8.8	1.07% (65th)	—	24.0.1-IF002	2024-03-28	2 versions
CVE-2024-34158US	—	1.05% (64th)	—	24.0.0-IF005	2024-09-06	2 versions
CVE-2024-20926US	—	1.03% (64th)	—	23.0.2-IF003	2024-01-16	2 versions
CVE-2024-21208US	—	1.01% (63rd)	—	24.0.0-IF005	2024-10-15	2 versions
CVE-2018-1999US	medium4.3	0.98% (62nd)	—	no fix	2019-04-08	3 versions
CVE-2019-4410US	medium5.4	0.97% (62nd)	—	no fix	2019-07-01	4 versions
CVE-2019-4204US	medium5.4	0.94% (61st)	—	no fix	2019-05-10	4 versions
CVE-2024-21235US	—	0.93% (60th)	—	24.0.1-IF002	2024-10-15	2 versions
CVE-2021-39046US	medium4.9	0.93% (60th)	—	no fix	2022-03-18	10 versions
CVE-2020-4446US	medium4.3OT elevated	0.90% (59th)	—	no fix	2020-05-06	2 versions
CVE-2021-29775US	medium5.4	0.88% (59th)	—	no fix	2021-06-28	8 versions
CVE-2019-4045US	medium4.3	0.87% (59th)	—	no fix	2019-04-08	3 versions
CVE-2024-20921US	—OT elevated	0.86% (58th)	—	23.0.2-IF003	2024-02-17	2 versions
CVE-2020-4490US	medium6.1	0.86% (58th)	—	no fix	2020-05-29	2 versions
CVE-2024-38809US	—	0.85% (58th)	—	24.0.0-IF004	2024-09-27	2 versions
CVE-2021-29751US	medium4.3	0.85% (58th)	—	no fix	2021-06-28	3 versions
CVE-2020-4794US	medium5.4OT elevated	0.85% (58th)	—	no fix	2020-12-21	3 versions
CVE-2024-34155US	—	0.84% (58th)	—	24.0.1-IF002	2024-09-06	2 versions
CVE-2019-4669US	medium6.3	0.83% (58th)	—	no fix	2020-02-27	2 versions
CVE-2020-4516US	medium5.4	0.81% (57th)	—	no fix	2020-09-08	3 versions
CVE-2024-21210US	—	0.81% (57th)	—	24.0.1-IF002	2024-10-15	2 versions
CVE-2021-29753US	medium5.9OT elevated	0.80% (56th)	—	no fix	2021-11-05	4 versions
CVE-2024-20919US	—	0.80% (56th)	—	21.0.3-IF031	2024-02-17	2 versions
CVE-2024-20932US	—	0.78% (56th)	—	21.0.3-IF031	2024-01-16	2 versions
CVE-2018-2000US	high8.8	0.76% (55th)	—	no fix	2019-04-08	2 versions
CVE-2023-38366US	medium5.3	0.75% (55th)	—	23.0.2	2024-03-01	2 versions
CVE-2019-4426US	medium5.4	0.75% (55th)	—	no fix	2019-12-13	2 versions
CVE-2024-45336US	—	0.73% (54th)	—	24.0.1-IF002	2025-01-28	2 versions
CVE-2024-45340US	—	0.71% (53rd)	—	24.0.0-IF005	2025-01-28	2 versions
CVE-2019-4149US	medium5.4	0.68% (52nd)	—	no fix	2019-09-05	2 versions
CVE-2024-21211US	—	0.67% (52nd)	—	24.0.1-IF002	2024-10-15	2 versions
CVE-2025-54121US	—	0.66% (51st)	—	24.0.0-IF007	2025-07-21	< 24.0.0-IF007
CVE-2025-22867US	—	0.65% (51st)	—	24.0.1-IF002	2025-02-06	2 versions
CVE-2021-29835US	medium6.1	0.64% (50th)	—	no fix	2021-10-22	4 versions

showing 50 of 95

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')27 CVEs
CWE-20Improper Input Validation11 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor8 CVEs
CWE-404Improper Resource Shutdown or Release5 CVEs
CWE-352Cross-Site Request Forgery (CSRF)4 CVEs
CWE-400Uncontrolled Resource Consumption3 CVEs
CWE-502Deserialization of Untrusted Data3 CVEs
CWE-674Uncontrolled Recursion3 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)55 CVEs
EUEU Vulnerability Database (ENISA)42 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan