IBM Emptoris Contract Management vulnerabilities

16 CVEs affecting IBM Emptoris Contract Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4897, published 2021-01-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-4483, published 2019-08-20. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements,…
CVE-2019-4481, published 2019-08-20. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements,…
CVE-2015-5042, published 2016-02-15. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote attackers…
CVE-2020-4897, published 2021-01-07. Medium severity, CVSS 5.3. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is…
CVE-2014-6212, published 2015-01-10. Medium severity, CVSS 4.0. EPSS: 1.4% chance of exploitation in the next 30 days. The Echo API in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix11, 10.0.0.x before 10.0.0.1 iFix12, 10.0.1.x before 10.0.1.5 iFix2, and 10.0.2.x before 10.0.2.2 iFix5; Emptoris Sourcing…
CVE-2018-1961, published 2019-04-29. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages. IBM X-Force ID: 153657.
CVE-2014-3041, published 2014-08-26. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. SQL injection vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 iFix 10, 10.0.1.x before 10.0.1.4, and 10.0.2.x before 10.0.2.2 iFix 2 allows…
CVE-2019-4485, published 2019-08-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive…
CVE-2019-4484, published 2019-08-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive…
CVE-2019-4308, published 2019-08-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive…

Latest

CVE-2020-4892, published 2021-01-07. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2016-6018, published 2017-07-19. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Contract Management 10.0 and 10.1 reveals detailed error messages in certain features that could cause an attacker to gain additional information to conduct further attacks. IBM X-Force…
CVE-2015-7398, published 2016-02-15. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x…