IBM Marketing Operations vulnerabilities

6 CVEs affecting IBM Marketing Operations, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4125, published 2020-07-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-6222, published 2015-06-07. Medium severity, CVSS 4.0. EPSS: 1.4% chance of exploitation in the next 30 days. Directory traversal vulnerability in IBM Marketing Operations 7.x and 8.x before 8.5.0.7.2, 8.6.x before 8.6.0.8, 9.0.x before 9.0.0.4.1, 9.1.0.x before 9.1.0.5, and 9.1.1.x before 9.1.1.2 allows…
CVE-2017-1119, published 2018-11-09. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Marketing Operations 9.1.0, 9.1.2, and 10.1 could allow a remote attacker to obtain sensitive information. An attacker could send a specially-crafted request to cause an error message to be…
CVE-2014-8887, published 2015-06-07. Medium severity, CVSS 4.0. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Marketing Operations 7.x and 8.x before 8.5.0.7.2, 8.6.x before 8.6.0.8, 9.0.x before 9.0.0.4.1, 9.1.0.x before 9.1.0.5, and 9.1.1.x before 9.1.1.2 allows remote authenticated users to upload…
CVE-2016-6112, published 2017-05-22. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative permissions over the web application.…
CVE-2014-6175, published 2015-06-07. Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Marketing Operations 7.x and 8.x before 8.5.0.7.2, 8.6.x before 8.6.0.8, 9.0.x before 9.0.0.4.1, 9.1.0.x before 9.1.0.5, and 9.1.1.x before 9.1.1.2…
CVE-2020-4125, published 2020-07-20. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Using HCL Marketing Operations 9.1.2.4, 10.1.x, 11.1.0.x, a malicious attacker could download files from the RHEL environment by doing some modification in the link, giving the attacker access to…