IBM Lotus Mobile Connect vulnerabilities

7 CVEs affecting IBM Lotus Mobile Connect, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-4465, published 2011-11-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-4595, published 2010-12-22. Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days. The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 disables the http.device.stanza blacklisting functionality for HTTP Access Services (HTTP-AS), which allows remote attackers to bypass…
CVE-2010-4592, published 2010-12-22. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. The Mobile Network Connections functionality in the Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not properly handle failed…
CVE-2010-4593, published 2010-12-22. Medium severity, CVSS 4.0. EPSS: 1.1% chance of exploitation in the next 30 days. The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote authenticated users to cause a denial of service (IP address…
CVE-2010-4590, published 2010-12-22. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in HTTP Access Services (HTTP-AS) in the Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4 allows remote attackers to inject arbitrary web…
CVE-2011-4465, published 2011-11-19. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Lotus Mobile Connect (LMC) 6.1.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to a hidden redirect URL.
CVE-2010-4594, published 2010-12-22. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. The Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not properly process TCP connection requests, which allows remote attackers to…
CVE-2010-4591, published 2010-12-22. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. The Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not delete LTPA tokens in response to use of the iNotes Logoff button,…