IBM Security Siteprotector System vulnerabilities

12 CVEs affecting IBM Security Siteprotector System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4150, published 2022-07-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-0160, published 2015-05-25. High severity, CVSS 9.0. EPSS: 2.9% chance of exploitation in the next 30 days. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary commands with SYSTEM privileges via…
CVE-2015-0172, published 2018-04-10. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Security SiteProtector System 3.0, 3.1.0 and 3.1.1 allows remote attackers to bypass intended security restrictions and consequently execute unspecified commands and obtain sensitive information…
CVE-2015-0171, published 2015-05-25. Medium severity, CVSS 5.5. EPSS: 1.3% chance of exploitation in the next 30 days. Directory traversal vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to write to arbitrary files…
CVE-2020-4146, published 2021-11-12. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A remote attacker could exploit this vulnerability to obtain…
CVE-2015-0161, published 2015-05-25. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. SQL injection vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary SQL commands…
CVE-2020-4150, published 2022-07-11. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. IBM SiteProtector Appliance 3.1.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external…
CVE-2015-0169, published 2015-05-25. Medium severity, CVSS 4.0. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arguments via unspecified vectors.
CVE-2015-0168, published 2015-05-25. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arbitrary…
CVE-2020-4140, published 2021-11-12. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Security SiteProtector System 3.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2015-0162, published 2017-09-20. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.

Latest

CVE-2020-4138, published 2022-07-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174049.
CVE-2015-0170, published 2015-05-25. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows local users to obtain sensitive information by reading cached data.