IBM Lotus Connections vulnerabilities

14 CVEs affecting IBM Lotus Connections, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-0503, published 2013-04-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-3469, published 2009-09-29. Medium severity, CVSS 4.3. EPSS: 3.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in profiles/html/simpleSearch.do in IBM Lotus Connections 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.
CVE-2008-4809, published 2008-10-31. High severity, CVSS 10.0. EPSS: 1.5% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the Profiles search pages in IBM Lotus Connections 2.x before 2.0.1 have unknown impact and attack vectors related to "Active" content. NOTE: the provenance…
CVE-2011-1032, published 2011-02-15. Medium severity, CVSS 6.8. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Lotus Connections 3.0, when IBM WebSphere Application Server 7.0.0.11 is used, does not properly restrict access to the internal login module, which has unspecified impact and attack vectors.
CVE-2010-2278, published 2010-06-15. Medium severity, CVSS 4.0. EPSS: 1.4% chance of exploitation in the next 30 days. The bookmarklet pop-up in the Bookmarks component in IBM Lotus Connections 2.5.x before 2.5.0.2 does not properly follow the "force SSL" setting, which might make it easier for remote attackers to…
CVE-2010-2279, published 2010-06-15. High severity, CVSS 7.6. EPSS: 1.3% chance of exploitation in the next 30 days. The Top Updates implementation in the Homepage component in IBM Lotus Connections 2.5.x before 2.5.0.2, when "forced SSL" is enabled, uses http for links, which has unspecified impact and remote…
CVE-2010-2277, published 2010-06-15. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Connections 2.5.x before 2.5.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) create or (2) edit form in…
CVE-2008-4805, published 2008-10-31. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the community title, (2) API input,…
CVE-2013-0503, published 2013-04-23. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Bookmarks component in IBM Lotus Connections before 4.0 CR3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2008-4806, published 2008-10-31. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Multiple SQL injection vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via the sortField parameter to unspecified components. NOTE:…
CVE-2011-1030, published 2011-02-14. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Wikis component in IBM Lotus Connections 3.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to the "Confirm New…

Latest

CVE-2010-2280, published 2010-06-15. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. Open redirect vulnerability in the Mobile component in IBM Lotus Connections 2.5.x before 2.5.0.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via…
CVE-2009-3816, published 2009-10-28. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Activities pages in the Mobile subsystem in IBM Lotus Connections 2.5.0.0 allow remote attackers to inject arbitrary web script or HTML via…