IBM Partner Engagement Manager vulnerabilities
10 CVEs affecting IBM Partner Engagement Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-34354, published 2022-11-16.
More from IBM.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2021-29781, published 2021-07-30. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker…
- CVE-2022-22360, published 2022-07-19. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker…
- CVE-2022-22358, published 2022-07-19. High severity, CVSS 7.1. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this…
- CVE-2022-22332, published 2022-04-01. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131.
- CVE-2022-22331, published 2022-04-01. High severity, CVSS 7.1. EPSS: 0.7% chance of exploitation in the next 30 days. IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability…
- CVE-2022-22417, published 2022-07-19. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
- CVE-2022-22416, published 2022-07-19. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests…
- CVE-2022-22359, published 2022-07-19. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
- CVE-2022-22328, published 2022-04-01. Medium severity, CVSS 6.2. EPSS: 0.2% chance of exploitation in the next 30 days. IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to another users data. IBM X-Force ID: 218871.
- CVE-2022-34354, published 2022-11-16. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM X-Force ID: 230424.