IBM Intelligent Operations Center vulnerabilities

11 CVEs affecting IBM Intelligent Operations Center, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4318, published 2020-07-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-4419, published 2019-08-20. High severity, CVSS 8.2. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to…
CVE-2019-4066, published 2019-06-07. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues and result in code execution. IBM X-Force…
CVE-2019-4068, published 2019-06-07. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force ID: 157013.
CVE-2019-4321, published 2019-09-05. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Water Operations for Waternamics V5.1.0 - V5.2.1.1 does not…
CVE-2019-4067, published 2019-06-07. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM…
CVE-2019-4069, published 2019-06-07. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Force ID: 157014.
CVE-2012-6360, published 2013-01-18. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Intelligent Operations Center 1.5.0 allows remote attackers to inject arbitrary web script or HTML via event data fields.
CVE-2020-4318, published 2020-07-28. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability…
CVE-2019-4070, published 2019-06-07. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the…
CVE-2020-4317, published 2020-07-28. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Intelligent Operations Center for Emergency Management, Intelligent Operations Center (IOC), and IBM Water Operations for Waternamics are vulnerable to cross-site scripting. This vulnerability…

Latest

CVE-2019-4420, published 2019-08-20. Medium severity, CVSS 6.2. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attacks against the system. IBM X-Force ID:…