IBM Tivoli Netcool/omnibus vulnerabilities

8 CVEs affecting IBM Tivoli Netcool/omnibus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4199, published 2020-03-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-1343, published 2011-03-09. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. SQL injection vulnerability in the Web GUI in IBM Tivoli Netcool/OMNIbus before 7.3.0.4 allows remote attackers to execute arbitrary SQL commands via "dynamic SQL parameters."
CVE-2014-3032, published 2015-01-17. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Web GUI in IBM Tivoli Netcool/OMNIbus 7.3.0 before 7.3.0.6, 7.3.1 before 7.3.1.7, and 7.4.0 before 7.4.0.3 allows remote authenticated users to inject…
CVE-2014-0942, published 2014-05-01. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script…
CVE-2014-0941, published 2014-05-01. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in webtop/eventviewer/eventViewer.jsp in the Web GUI in IBM Netcool/OMNIbus 7.4.0 before FP2 allows remote authenticated users to inject arbitrary web script…
CVE-2020-4198, published 2020-03-03. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4196, published 2020-03-03. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4199, published 2020-03-18. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website…
CVE-2020-4197, published 2020-03-03. Low severity, CVSS 2.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174908.