IBM Flex System Manager vulnerabilities

5 CVEs affecting IBM Flex System Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-6147, published 2015-02-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-5438, published 2013-12-14. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the web server in IBM Flex System Manager (FSM) 1.1.0 through 1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-5423, published 2014-07-07. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Flex System Manager (FSM) 1.1 through 1.3 before 1.3.2.0 allows remote attackers to enumerate user accounts via unspecified vectors.
CVE-2013-5424, published 2013-10-25. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Flex System Manager (FSM) 1.3.0 allows remote attackers to bypass intended access restrictions, and create new user accounts or execute tasks, by leveraging an expired password for the…
CVE-2014-0897, published 2014-08-29. Low severity, CVSS 3.5. EPSS: 0.6% chance of exploitation in the next 30 days. The Configuration Patterns component in IBM Flex System Manager (FSM) 1.2.0.x, 1.2.1.x, 1.3.0.x, and 1.3.1.x uses a weak algorithm in an encryption step during Chassis Management Module (CMM) account…
CVE-2014-6147, published 2015-02-19. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Flex System Manager (FSM) 1.1.x.x, 1.2.0.x, 1.2.1.x, 1.3.0.0, 1.3.1.0, and 1.3.2.0 allows local users to obtain sensitive information, and consequently gain privileges or conduct impersonation…