IBM Soar vulnerabilities

4 CVEs affecting IBM Soar, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-45670, published 2024-11-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-29785, published 2022-01-20. Medium severity, CVSS 5.9. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Security SOAR V42 and V43could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this…
CVE-2020-4635, published 2021-03-19. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Resilient SOAR 40 and earlier could disclose sensitive information by allowing a user to enumerate usernames.
CVE-2024-38319, published 2024-06-22. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Security SOAR 51.0.2.0 could allow an authenticated user to execute malicious code loaded from a specially crafted script. IBM X-Force ID: 294830.
CVE-2024-45670, published 2024-11-14. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the…