Opentext Exceed Ondemand vulnerabilities

4 CVEs affecting Opentext Exceed Ondemand, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-6994, published 2014-05-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-6994, published 2014-05-19. Medium severity, CVSS 6.4. EPSS: 1.2% chance of exploitation in the next 30 days. OpenText Exceed OnDemand (EoD) 8 transmits the session ID in cleartext, which allows remote attackers to perform session fixation attacks by sniffing the network.
CVE-2013-6806, published 2014-05-19. Medium severity, CVSS 6.8. EPSS: 1% chance of exploitation in the next 30 days. OpenText Exceed OnDemand (EoD) 8 allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via a crafted string in a response, which triggers a…
CVE-2013-6805, published 2014-05-19. Medium severity, CVSS 5.0. EPSS: 0.7% chance of exploitation in the next 30 days. OpenText Exceed OnDemand (EoD) 8 uses weak encryption for passwords, which makes it easier for (1) remote attackers to discover credentials by sniffing the network or (2) local users to discover…
CVE-2013-6807, published 2014-05-19. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. The client in OpenText Exceed OnDemand (EoD) 8 supports anonymous ciphers by default, which allows man-in-the-middle attackers to bypass server certificate validation, redirect a connection, and…