CVE-2025-36254

HighCVSS 7.4/10Last modified Sep 29, 2026

Description

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2026
Last modified: Sep 29, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-362558.8IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to cre CVE-2025-362585.5IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text wh CVE-2025-36269.1A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in CVE-2025-362624.9IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to ga CVE-2025-36274.3A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they fi CVE-2025-362715.9IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to CVE-2025-362747.5IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an un CVE-2025-36284.3A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities.CVE-2025-36294.3IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an authenticated user to delete another user's comments due to imp CVE-2025-362905.9IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could a CVE-2025-362985.4IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 a CVE-2025-362994.3IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the s