IBM Security Appscan Source vulnerabilities

14 CVEs affecting IBM Security Appscan Source, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-6120, published 2018-04-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-6120, published 2018-04-12. Critical severity, CVSS 9.8. EPSS: 5% chance of exploitation in the next 30 days. IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1 allow remote…
CVE-2014-6119, published 2014-12-23. High severity, CVSS 9.3. EPSS: 3.6% chance of exploitation in the next 30 days. IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows…
CVE-2012-2159, published 2012-06-20. Medium severity, CVSS 5.8. EPSS: 1.8% chance of exploitation in the next 30 days. Open redirect vulnerability in IBM Eclipse Help System (IEHS), as used in IBM Security AppScan Source 7.x and 8.x before 8.6 and IBM SPSS Data Collection Developer Library 6.0 and 6.0.1, allows…
CVE-2012-2161, published 2012-06-20. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in deferredView.jsp in IBM Eclipse Help System (IEHS), as used in IBM Security AppScan Source 7.x and 8.x before 8.6 and IBM SPSS Data Collection Developer…
CVE-2014-6122, published 2014-12-23. Medium severity, CVSS 5.5. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows…
CVE-2012-2173, published 2012-06-20. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. The ODBC driver in IBM Security AppScan Source 7.x and 8.x before 8.6 sends an SHA-1 hash of the connection password during connections to a solidDB database, which allows remote attackers to obtain…
CVE-2014-6135, published 2014-12-23. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows…
CVE-2016-3035, published 2017-02-01. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server.
CVE-2014-6121, published 2014-12-23. Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix…
CVE-2014-0936, published 2014-06-08. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Security AppScan Source 8.0 through 9.0, when the publish-assessment permission is not properly restricted for the configured database server, transmits cleartext assessment data, which allows…

Latest

CVE-2016-3034, published 2017-02-01. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM AppScan Source uses a one-way hash without salt to encrypt highly sensitive information, which could allow a local attacker to decrypt information more easily.
CVE-2014-6123, published 2014-12-29. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1 allow local users to…
CVE-2014-4812, published 2014-10-26. Low severity, CVSS 1.8. EPSS: 0.5% chance of exploitation in the next 30 days. The installer in IBM Security AppScan Source 8.x and 9.x through 9.0.1 has an open network port for a debug service, which allows remote attackers to obtain sensitive information by connecting to…
CVE-2014-3072, published 2014-08-12. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the Automation Server in IBM Security AppScan Source 8 through 8.0.0.2, 8.5 through 8.5.0.1, 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, and 9.0 through 9.0.0.1 allows…