IBM Powersc vulnerabilities

13 CVEs affecting IBM Powersc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-50962, published 2024-02-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-50326, published 2024-02-02. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 275107.
CVE-2023-50328, published 2024-02-02. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings. IBM X-Force ID: 275110.
CVE-2023-50327, published 2024-02-02. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 uses insecure HTTP methods which could allow a remote attacker to perform unauthorized file request modification. IBM X-Force ID: 275109.
CVE-2023-50940, published 2024-02-02. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not…
CVE-2023-50934, published 2024-02-02. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme. IBM X-Force…
CVE-2023-50933, published 2024-02-02. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security…
CVE-2023-50935, published 2024-02-02. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to application functionality and/or resources. …
CVE-2023-50938, published 2024-02-02. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this…
CVE-2023-50936, published 2024-02-02. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 275116.
CVE-2023-50939, published 2024-02-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 275129.

Latest

CVE-2023-50962, published 2024-02-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism. IBM X-Force ID: 276004.
CVE-2023-50941, published 2024-02-02. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 does not provide logout functionality, which could allow an authenticated user to gain access to an unauthorized user using session fixation. IBM X-Force ID: 275131.
CVE-2023-50937, published 2024-02-02. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 275117.