IBM Rational Appscan vulnerabilities

13 CVEs affecting IBM Rational Appscan, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-0737, published 2012-05-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-1367, published 2011-10-30. High severity, CVSS 9.3. EPSS: 3.6% chance of exploitation in the next 30 days. Unspecified vulnerability in the File Load feature in IBM Rational AppScan Standard and Express 7.8.x, 7.9.x, and 8.0.x before 8.0.0.3 allows remote attackers to execute arbitrary commands via a…
CVE-2012-0736, published 2012-05-03. High severity, CVSS 9.3. EPSS: 2.9% chance of exploitation in the next 30 days. IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly create scan jobs, which allows remote attackers to execute arbitrary code via a crafted web site.
CVE-2011-1366, published 2011-10-30. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. Unspecified vulnerability in the Import feature in IBM Rational AppScan Enterprise and AppScan Reporting Console 5.2 through 7.9.x and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary…
CVE-2009-1056, published 2009-03-24. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Rational AppScan Enterprise before 5.5 FP1 allows remote attackers to read arbitrary exported reports by "forcefully browsing."
CVE-2012-0735, published 2012-05-03. High severity, CVSS 7.6. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly scan file: URLs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified…
CVE-2012-0734, published 2012-05-03. High severity, CVSS 7.6. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly import jobs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other…
CVE-2009-3745, published 2009-10-22. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the help pages in IBM Rational AppScan Enterprise Edition 5.5.0.2 allows remote attackers to inject arbitrary web script or HTML via the query string.
CVE-2012-0731, published 2012-05-03. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not prevent service-account impersonation, which allows remote authenticated users to read arbitrary files via unspecified vectors.
CVE-2012-0733, published 2012-05-03. Medium severity, CVSS 6.0. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1, when Integrated Windows authentication is used, allows remote authenticated users to obtain administrative privileges by hijacking a…
CVE-2012-0729, published 2012-05-03. Medium severity, CVSS 6.0. EPSS: 1.1% chance of exploitation in the next 30 days. Unrestricted file upload vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to execute arbitrary ASP.NET code by uploading a .aspx file, and…

Latest

CVE-2012-0737, published 2012-05-03. Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-0732, published 2012-05-03. Medium severity, CVSS 5.8. EPSS: 0.6% chance of exploitation in the next 30 days. The Enterprise Console client in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof…
CVE-2012-0730, published 2012-05-03. Medium severity, CVSS 6.0. EPSS: 0.5% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allow remote attackers to hijack the authentication of administrators for…