IBM Control Center vulnerabilities

9 CVEs affecting IBM Control Center, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-43052, published 2025-03-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-1758, published 2018-02-21. High severity, CVSS 7.1. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, and 3.1.0, IBM Transformation Extender…
CVE-2021-20529, published 2021-05-19. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM X-Force ID: 198763.
CVE-2021-20528, published 2021-05-19. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2024-35114, published 2025-01-25. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts.
CVE-2023-43052, published 2025-03-07. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this…
CVE-2024-35111, published 2025-01-25. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2024-35113, published 2025-01-25. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Control Center 6.2.1 and 6.3.1 could allow an authenticated user to obtain sensitive information exposed through a directory listing.
CVE-2024-35112, published 2025-01-25. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used…
CVE-2016-0252, published 2016-07-08. Medium severity, CVSS 5.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Control Center 6.x before 6.0.0.1 iFix06 and Sterling Control Center 5.4.x before 5.4.2.1 iFix09 allow local users to decrypt the master key via unspecified vectors.