Approved changes feed: RSS · Atom

cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*

part: a version: 9.0.0.1 update: *

VendorIbm (177c0602-9232-5933-8f2f-9d22f079d22d)
ProductOperational Decision Manager (99d97d7f-936f-508f-b489-931ef13828bc)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-18658 vulnerable 2026-09-16 04:34:02.061686 IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed
CRITICAL (9.8)
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
Published: 2026-09-04T16:10:18.743Z
Updated: 2026-09-11T11:49:18.618Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-2824 vulnerable 2026-06-08 07:16:58.435945 IBM Operational Decision Manager HTTP open redirect
HIGH (7.4)
IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Published: 2025-08-01T17:46:30.472Z
Updated: 2025-08-01T18:07:22.830Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-1551 vulnerable 2026-06-08 07:08:37.283106 IBM Operational Decision Manager cross-site scripting
MEDIUM (6.1)
IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, and 9.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Published: 2025-04-29T15:41:43.471Z
Updated: 2025-08-28T15:03:15.862Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.