IBM Emptoris Sourcing vulnerabilities

16 CVEs affecting IBM Emptoris Sourcing, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4896, published 2021-01-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-8947, published 2017-07-12. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a…
CVE-2019-4485, published 2019-08-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive…
CVE-2019-4484, published 2019-08-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive…
CVE-2019-4308, published 2019-08-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive…
CVE-2016-8950, published 2017-07-12. Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2015-5024, published 2015-10-06. Medium severity, CVSS 4.0. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before iFix1, and 10.0.4.x before iFix2 allows remote…
CVE-2020-4896, published 2021-01-07. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP request headers. IBM X-Force ID: 190987.
CVE-2017-1450, published 2017-08-31. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote…
CVE-2016-8948, published 2017-07-12. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2016-8946, published 2017-07-12. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…

Latest

CVE-2016-0329, published 2018-02-02. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Open redirect vulnerability in IBM Emptoris Sourcing 10.0.0.x before 10.0.0.1_iFix3, 10.0.1.x before 10.0.1.3_iFix3, 10.0.2.x before 10.0.2.8_iFix1, 10.0.4.0 before 10.0.4.0_iFix8, and 10.1.0.0…
CVE-2017-1449, published 2017-08-31. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote…
CVE-2017-1447, published 2017-08-31. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2017-1444, published 2017-08-31. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2016-8953, published 2017-07-12. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a…