IBM Curam Social Program Management vulnerabilities

46 CVEs affecting IBM Curam Social Program Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22318, published 2022-06-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-8903, published 2017-08-02. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrary Java classes via unspecified vectors.
CVE-2016-6111, published 2017-03-31. Critical severity, CVSS 9.1. EPSS: 2.1% chance of exploitation in the next 30 days. IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit…
CVE-2020-4776, published 2020-10-12. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remote attacker to traverse directories on the system. An attacker could send a…
CVE-2018-1671, published 2018-12-10. Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within…
CVE-2020-4772, published 2020-10-12. High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days. An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive…
CVE-2020-4781, published 2020-10-12. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could result in a denial of service. IBM X-Force ID: 189159.
CVE-2015-7401, published 2018-03-26. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive document information by guessing the document…
CVE-2018-1654, published 2018-12-11. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a…
CVE-2014-4843, published 2017-06-08. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information…
CVE-2014-6092, published 2015-04-27. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the…

Latest

CVE-2022-22318, published 2022-06-20. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
CVE-2022-22317, published 2022-06-20. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 218281.
CVE-2021-39068, published 2022-04-11. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2020-4942, published 2021-01-04. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…
CVE-2020-4780, published 2020-10-12. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent…
CVE-2020-4779, published 2020-10-12. High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days. A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass…
CVE-2020-4778, published 2020-10-12. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the CÃºram…
CVE-2020-4775, published 2020-10-12. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for…