IBM Openpages Grc Platform vulnerabilities

22 CVEs affecting IBM Openpages Grc Platform, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-27257, published 2024-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-1333, published 2017-11-01. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow an unauthenticated user to obtain sensitive information about the server that could be used in future attacks against the system. IBM X-Force…
CVE-2017-1148, published 2017-11-01. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 7.2 and 7.3 with OpenPages Loss Event Entry (LEE) application could allow a user to obtain sensitive information including private APIs that could be used in further…
CVE-2011-1381, published 2014-06-27. Medium severity, CVSS 6.4. EPSS: 1.2% chance of exploitation in the next 30 days. Unspecified vulnerability in IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote attackers to bypass intended access restrictions via unknown vectors.
CVE-2015-0141, published 2015-10-03. Medium severity, CVSS 4.0. EPSS: 1.1% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to modify arbitrary user filters via a JSON request.
CVE-2014-3011, published 2014-06-27. Medium severity, CVSS 5.0. EPSS: 1% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote attackers to conduct link injection attacks via unspecified vectors.
CVE-2015-0142, published 2015-10-03. Medium severity, CVSS 4.0. EPSS: 1% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-mode transition and…
CVE-2020-4536, published 2021-05-11. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2015-0143, published 2015-10-03. Medium severity, CVSS 4.0. EPSS: 1% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading error messages.
CVE-2016-3049, published 2017-10-24. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser…
CVE-2015-0144, published 2015-10-03. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to inject…

Latest

CVE-2024-27257, published 2024-09-10. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM OpenPages 8.3 and 9.0 potentially exposes information about client-side source code through use of JavaScript source maps to unauthorized users.
CVE-2024-35151, published 2024-08-22. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs.
CVE-2020-4535, published 2021-05-11. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 8.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2017-1679, published 2018-09-10. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allow an attacker to obtain sensitive information from error log files. IBM X-Force ID: 134001.
CVE-2016-0234, published 2018-08-30. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neglected to close their browser. IBM…
CVE-2017-1300, published 2017-11-01. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the…
CVE-2017-1290, published 2017-11-01. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…