CVE-2025-36157

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

IBM Jazz Foundation 7.0.2 to 7.0.2 iFix035, 7.0.3 to 7.0.3 iFix018, and 7.1.0 to 7.1.0 iFix004 could allow an unauthenticated remote attacker to update server property files that would allow them to perform unauthorized actions.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
IBM	Engineering Lifecycle Management	>= 7.0.2, <= 7.0.2 iFix035; >= 7.0.3, <= 7.0.3 iFix018; >= 7.1.0, <= 7.1.0 iFix004

References

https://www.ibm.com/support/pages/node/7242925Patch, Vendor Advisory

Timeline

Published: Aug 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-361585.5IBM Concert 1.0.0 through 2.0.0 could allow a local user with specific permission to obtain sensitive information from files due to uncontro CVE-2025-361595.5IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their identity due to imprope CVE-2025-36168.8The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val CVE-2025-361607.5IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks aga CVE-2025-361615.9IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP CVE-2025-361624.3IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8.1 before 8.1.2.2 could allow an authenticated user to obtain sensitive information about co CVE-2025-36177.8A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the te CVE-2025-361705.4IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows CVE-2025-361714.9IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due CVE-2025-361725.4IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 In CVE-2025-361736.1Affected Product(s)Version(s)InfoSphere Data Architect9.2.1 CVE-2025-361748.0IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could