IBM Rational License Key Server vulnerabilities

6 CVEs affecting IBM Rational License Key Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-5045, published 2018-03-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-1389, published 2012-01-19. High severity, CVSS 10.0. EPSS: 6.8% chance of exploitation in the next 30 days. Multiple directory traversal vulnerabilities in the vendor daemon in Rational Common Licensing in Telelogic License Server 2.0, Rational License Server 7.x, and ibmratl in IBM Rational License Key…
CVE-2014-0909, published 2014-09-10. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier…
CVE-2014-3079, published 2014-09-10. Low severity, CVSS 2.1. EPSS: 1.6% chance of exploitation in the next 30 days. The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 allows remote authenticated users to bypass authorization checks and visit unspecified URLs with…
CVE-2015-1907, published 2015-05-08. Medium severity, CVSS 4.0. EPSS: 1.6% chance of exploitation in the next 30 days. The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4 before 8.1.4.7 allows remote authenticated users to read cookies via unspecified vectors.
CVE-2014-4756, published 2014-09-10. Low severity, CVSS 3.5. EPSS: 1.4% chance of exploitation in the next 30 days. The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors.
CVE-2015-5045, published 2018-03-26. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Administration and Reporting tool in IBM Rational License Key Server (RLKS) before 8.1.4.9 iFix 04 allows local users to obtain sensitive information via unspecified vectors. IBM X-Force ID:…