IBM Pureapplication System vulnerabilities

10 CVEs affecting IBM Pureapplication System, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-4241, published 2019-06-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 100% chance of exploitation in the next 30 days. GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,…
CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-25. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 99.9% chance of exploitation in the next 30 days. GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or…
CVE-2015-0235, published 2015-01-28. High severity, CVSS 10.0. EPSS: 94.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors…
CVE-2014-6158, published 2015-01-10. High severity, CVSS 9.0. EPSS: 3.7% chance of exploitation in the next 30 days. Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10, 1.1 before 1.1.0.5, and 2.0 before 2.0.0.1 and Workload Deployer…
CVE-2019-4235, published 2019-06-26. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force…
CVE-2019-4224, published 2019-06-26. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. IBM PureApplication System 2.2.3.0 through 2.2.5.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify…
CVE-2019-4234, published 2019-06-26. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM PureApplication System 2.2.3.0 through 2.2.5.3 weakness in the implementation of locking feature in pattern editor. An attacker by intercepting the subsequent requests can bypass business logic…
CVE-2014-0960, published 2014-06-14. Medium severity, CVSS 6.6. EPSS: 0.6% chance of exploitation in the next 30 days. IBM PureApplication System 1.0 before 1.0.0.4 cfix8 and 1.1 before 1.1.0.4 IF1 allows remote authenticated users to bypass intended access restrictions by establishing an SSH session from a deployed…
CVE-2019-4241, published 2019-06-26. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM PureApplication System 2.2.3.0 through 2.2.5.3 could allow an authenticated user with local access to bypass authentication and obtain administrative access. IBM X-Force ID: 159467.
CVE-2019-4225, published 2019-06-26. Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM PureApplication System 2.2.3.0 through 2.2.5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 159242.