IBM Sterling Order Management vulnerabilities

5 CVEs affecting IBM Sterling Order Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-33959, published 2023-04-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-0932, published 2014-04-21. Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 before HF105 and Sterling Selling and Fulfillment Foundation 9.0 before HF85 allows remote authenticated users to inject…
CVE-2015-1911, published 2015-05-25. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales (SFS) 9.0 before HF7 in…
CVE-2021-20554, published 2021-09-30. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Sterling Order Management 9.4, 9.5, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2022-34333, published 2023-04-07. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Sterling Order Management 10.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 229698.
CVE-2022-33959, published 2023-04-07. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Sterling Order Management 10.0 could allow a user to bypass validation and perform unauthorized actions on behalf of other users. IBM X-Force ID: 229320.