IBM Powervc vulnerabilities

7 CVEs affecting IBM Powervc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-1950, published 2015-07-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-1937, published 2015-05-30. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or…
CVE-2014-4749, published 2014-08-20. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key.
CVE-2015-0137, published 2015-03-24. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. IBM PowerVC Standard 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 validates Hardware Management Console (HMC) certificates only during the pre-login stage, which allows man-in-the-middle attackers…
CVE-2014-4750, published 2014-08-20. Low severity, CVSS 2.9. EPSS: 0.6% chance of exploitation in the next 30 days. IBM PowerVC Express Edition 1.2.0 before FixPack3 establishes an FTP session for transferring files to a managed IVM, which allows remote attackers to discover credentials by sniffing the network.
CVE-2015-0136, published 2015-03-24. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and PowerKVM management, which allows local users to obtain…
CVE-2015-1950, published 2015-07-01. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain…
CVE-2014-3093, published 2014-08-29. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in (1) api-paste.ini, (2) debug logs, (3) the installation process, (4) environment checks, (5) powervc-ldap-config, (6)…