IBM Emptoris Services Procurement vulnerabilities

4 CVEs affecting IBM Emptoris Services Procurement, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-1443, published 2017-08-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-1440, published 2017-08-30. High severity, CVSS 8.8. EPSS: 3% chance of exploitation in the next 30 days. IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a malicious file from a remote…
CVE-2017-1443, published 2017-08-30. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2017-1442, published 2017-08-30. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the…
CVE-2017-1441, published 2017-08-30. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Emptoris Services Procurement 10.0.0.5 could allow a local user to view sensitive information stored locally due to improper access control. IBM X-Force ID: 128106.