IBM Spss Statistics vulnerabilities
6 CVEs affecting IBM Spss Statistics, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-31896, published 2025-03-25.
More from IBM.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2015-0140, published 2015-05-25. Medium severity, CVSS 6.8. EPSS: 1.9% chance of exploitation in the next 30 days. An unspecified ActiveX control in IBM SPSS Statistics 22.0 through FP1 on 32-bit platforms allows remote attackers to execute arbitrary code via a crafted HTML document.
- CVE-2015-8530, published 2016-05-14. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. Stack-based buffer overflow in the Initialize function in an ActiveX control in IBM SPSS Statistics 19 and 20 before 20.0.0.2-IF0008, 21 before 21.0.0.2-IF0010, 22 before 22.0.0.2-IF0011, 23 before…
- CVE-2015-7489, published 2016-01-01. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM SPSS Statistics 22.0.0.2 before IF10 and 23.0.0.2 before IF7 uses weak permissions (Everyone: Write) for Python scripts, which allows local users to gain privileges by modifying a script.
- CVE-2021-38959, published 2021-11-17. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing arbitrary files to admin protected directories on the system.…
- CVE-2024-31896, published 2025-03-25. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM SPSS Statistics 26.0, 27.0.1, 28.0.1, and 29.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- CVE-2022-43855, published 2024-03-08. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM SPSS Statistics 26.0, 27.0.1, and 28.0 IO Module could allow a local user to create multiple files that could exhaust the file handles capacity and cause a denial of service.