IBM Daeja Viewone vulnerabilities

10 CVEs affecting IBM Daeja Viewone, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-4246, published 2019-10-01.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-4456, published 2019-07-30. High severity, CVSS 7.1. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this…
• CVE-2018-1835, published 2018-11-02. High severity, CVSS 7.1. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to…
• CVE-2017-1308, published 2017-07-13. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due to improper access controls. IBM X-Force…
• CVE-2017-1210, published 2017-10-24. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitimate. IBM X-Force ID: 123850.
• CVE-2019-4260, published 2019-07-02. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Daeja ViewONE Professional, Standard & Virtual 5.0 through 5.0.5 could allow an unauthorized user to download server files resulting in sensitive information disclosure. IBM X-Force ID: 160012.
• CVE-2019-4246, published 2019-10-01. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in further attacks against the system. IBM X-Force ID: 159521.
• CVE-2017-1212, published 2017-10-24. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to a denial of service when viewing or opening a large file. IBM X-Force ID: 123852.
• CVE-2018-1399, published 2018-02-27. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering…
• CVE-2017-1209, published 2017-10-24. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
• CVE-2017-1211, published 2017-10-24. Low severity, CVSS 2.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could disclose sensitive information to a local user when logging is enabled. IBM X-Force ID: 123851.