IBM Rational Focal Point vulnerabilities

9 CVEs affecting IBM Rational Focal Point, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-0841, published 2018-04-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-0842, published 2014-02-26. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. The account-creation functionality in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 places the new user's default password within the creation page, which allows…
CVE-2014-0843, published 2014-02-26. Low severity, CVSS 3.5. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to inject arbitrary web script or HTML by…
CVE-2014-0840, published 2014-02-26. Low severity, CVSS 3.5. EPSS: 1.1% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allow remote authenticated users to inject arbitrary web script…
CVE-2014-0853, published 2014-02-26. Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the (1) ForwardController and (2) AttributeEditor scripts in IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1…
CVE-2013-3025, published 2013-10-17. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in IBM Rational Focal Point 6.5.x and 6.6.x before 6.6.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-0839, published 2014-02-26. Medium severity, CVSS 4.0. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Rational Focal Point 6.4.x and 6.5.x before 6.5.2.3 and 6.6.x before 6.6.1 allows remote authenticated users to modify data via vectors involving a direct object reference.
CVE-2013-5398, published 2013-12-18. Low severity, CVSS 3.3. EPSS: 0.6% chance of exploitation in the next 30 days. Unspecified vulnerability in the Webservice Axis Gateway in IBM Rational Focal Point 6.4 before devfix1, 6.4.1.3 before devfix1, 6.5.1 before devfix1, 6.5.2 before devfix4, 6.5.2.3 before devfix9,…
CVE-2013-5397, published 2013-12-18. Low severity, CVSS 3.3. EPSS: 0.6% chance of exploitation in the next 30 days. Unspecified vulnerability in the Webservice Axis Gateway in IBM Rational Focal Point 6.4 before devfix1, 6.4.1.3 before devfix1, 6.5.1 before devfix1, 6.5.2 before devfix4, 6.5.2.3 before devfix9,…
CVE-2014-0841, published 2018-04-27. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Rational Focal Point 6.4.0, 6.4.1, 6.5.1, 6.5.2, and 6.6.0 use a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a…