IBM Smartcloud Provisioning vulnerabilities

3 CVEs affecting IBM Smartcloud Provisioning, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-7169, published 2014-09-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 100% chance of exploitation in the next 30 days. GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,…
CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-25. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 99.9% chance of exploitation in the next 30 days. GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or…
CVE-2013-5455, published 2013-12-07. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. IBM SmartCloud Provisioning 2.1 before FP3 IF0001 allows remote authenticated users to modify virtual-system deployment via deployer.virtualsystems CLI commands, as demonstrated by a deletion using a…