IBM Security Privileged Identity Manager Virtual Appliance vulnerabilities

7 CVEs affecting IBM Security Privileged Identity Manager Virtual Appliance, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-5974, published 2016-09-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-5970, published 2016-09-26. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files via a .. (dot…
CVE-2016-5963, published 2016-09-26. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 does not properly validate updates, which allows remote authenticated users to execute arbitrary code via…
CVE-2016-5957, published 2016-09-26. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive information by…
CVE-2016-5971, published 2016-09-26. High severity, CVSS 7.1. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via…
CVE-2016-3040, published 2016-09-26. Medium severity, CVSS 6.8. EPSS: 1.1% chance of exploitation in the next 30 days. IBM WebSphere Application Server (WAS) Liberty, as used in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8, allows remote authenticated users to redirect users…
CVE-2016-5972, published 2016-09-26. Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 uses weak permissions for unspecified resources, which allows remote authenticated users to obtain sensitive…
CVE-2016-5974, published 2016-09-26. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to inject arbitrary…