IBM Forms Experience Builder vulnerabilities

5 CVEs affecting IBM Forms Experience Builder, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-6169, published 2018-04-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-0369, published 2018-02-21. Low severity, CVSS 2.7. EPSS: 1% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sensitive information via crafted XML data. IBM X-Force ID:…
CVE-2016-0370, published 2016-09-01. Low severity, CVSS 2.7. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an…
CVE-2014-6169, published 2018-04-12. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.0 and 8.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 97777.
CVE-2016-6001, published 2017-02-01. Low severity, CVSS 3.1. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing for some information disclosure of internal resources.
CVE-2016-2884, published 2016-11-30. High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, allows remote authenticated users to…