IBM Platform Symphony vulnerabilities

8 CVEs affecting IBM Platform Symphony, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1708, published 2018-10-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1595, published 2018-08-01. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622.
CVE-2013-5400, published 2014-02-14. High severity, CVSS 10.0. EPSS: 2.3% chance of exploitation in the next 30 days. An unspecified servlet in IBM Platform Symphony Developer Edition (DE) 5.2 and 6.1.x through 6.1.1 has hardcoded credentials, which allows remote attackers to bypass authentication and obtain "local…
CVE-2018-1702, published 2018-09-28. High severity, CVSS 7.1. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker…
CVE-2013-5387, published 2013-11-06. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. Buffer overflow in IBM Platform Symphony 5.2, 6.1, and 6.1.1 allows remote attackers to cause a denial of service (process crash or hang) via a malformed SOAP request with a large amount of request…
CVE-2018-1705, published 2018-08-28. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly…
CVE-2018-1708, published 2018-10-11. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to obtain sensitive user information such as passwords through the WebUI. IBM X-Force ID: 146343.
CVE-2018-1704, published 2018-09-28. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a…
CVE-2013-6305, published 2014-01-21. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Platform Symphony 5.2 before build 229037 and 6.1.0.1 before build 229073 uses the same credentials encryption key across different customers' installations, which makes it easier for…