Emc Sourceone Email Supervisor vulnerabilities

4 CVEs affecting Emc Sourceone Email Supervisor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-6846, published 2015-10-18.

More from Emc.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-6845, published 2015-10-18. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. EMC SourceOne Email Supervisor before 7.2 does not properly employ random values for session IDs, which makes it easier for remote attackers to obtain access by guessing an ID.
• CVE-2015-6843, published 2015-10-18. Medium severity, CVSS 5.0. EPSS: 2.9% chance of exploitation in the next 30 days. Reviewer in EMC SourceOne Email Supervisor before 7.2 does not properly limit attempts to authenticate, which makes it easier for remote attackers to obtain access via a brute-force approach.
• CVE-2015-6844, published 2015-10-18. Medium severity, CVSS 4.3. EPSS: 2.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Reviewer in EMC SourceOne Email Supervisor before 7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
• CVE-2015-6846, published 2015-10-18. Medium severity, CVSS 6.8. EPSS: 1.1% chance of exploitation in the next 30 days. EMC SourceOne Email Supervisor before 7.2 uses hardcoded encryption keys, which makes it easier for attackers to obtain access by examining how a program's code conducts cryptographic operations.