IBM Emptoris Spend Analysis vulnerabilities

14 CVEs affecting IBM Emptoris Spend Analysis, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4897, published 2021-01-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-4483, published 2019-08-20. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements,…
CVE-2019-4481, published 2019-08-20. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements,…
CVE-2020-4897, published 2021-01-07. Medium severity, CVSS 5.3. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is…
CVE-2019-4752, published 2020-02-20. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Emptoris Spend Analysis and IBM Emptoris Strategic Supply Management Platform 10.1.0.x, 10.1.1.x, and 10.1.3.x is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL…
CVE-2019-4485, published 2019-08-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive…
CVE-2019-4484, published 2019-08-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive…
CVE-2019-4308, published 2019-08-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive…
CVE-2014-3035, published 2014-08-26. Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 allows remote authenticated users to inject…
CVE-2014-3040, published 2014-08-26. Medium severity, CVSS 6.0. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.x before 9.5.0.6 iFix 10, 10.0.0.x before 10.0.0.1 iFix 10, 10.0.1.x before 10.0.1.4, and 10.0.2.x before…
CVE-2014-4790, published 2014-08-26. Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 and Emptoris Spend Analysis 9.5.x before 9.5.0.4, 10.0.1.x…

Latest

CVE-2019-4482, published 2019-08-20. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2017-1446, published 2017-08-30. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2017-1445, published 2017-08-30. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…