IBM Campaign vulnerabilities

8 CVEs affecting IBM Campaign, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1921, published 2019-07-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-4384, published 2019-06-19. Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days. IBM Campaign 9.1.2 and 10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view…
CVE-2017-1116, published 2018-04-27. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Campaign 8.6, 9.0, 9.1, 9.1.1, 9.1.2, and 10.0 contains excessive details on the client side which could provide information useful for an authenticated user to conduct other attacks. IBM X-Force…
CVE-2017-1115, published 2018-09-07. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the…
CVE-2016-0265, published 2017-02-01. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute…
CVE-2018-1921, published 2019-07-17. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Campaign 9.1.0, 9.1.2, 10.1, and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2017-1114, published 2018-09-07. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2016-9749, published 2018-11-09. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass security due to lack of input validation. IBM X-Force ID: 120206.
CVE-2018-1941, published 2018-12-05. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating access permissions. IBM X-Force ID: 153382.