IBM Tivoli Workload Scheduler vulnerabilities

7 CVEs affecting IBM Tivoli Workload Scheduler, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-38389, published 2023-02-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22486, published 2023-02-03. Critical severity, CVSS 9.1. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose…
CVE-2022-38389, published 2023-02-03. Critical severity, CVSS 9.1. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose…
CVE-2019-4608, published 2020-03-10. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Tivoli Workload Scheduler 9.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2019-4031, published 2019-10-16. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Workload Scheduler Distributed 9.2, 9.3, 9.4, and 9.5 contains a vulnerability that could allow a local user to write files as root in the file system, which could allow the attacker to gain root…
CVE-2018-1386, published 2018-03-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Tivoli Workload Automation for AIX (IBM Workload Scheduler 8.6, 9.1, 9.2, 9.3, and 9.4) contains directories with improper permissions that could allow a local user to with special access to gain…
CVE-2017-1716, published 2017-12-13. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Tivoli Workload Scheduler 8.6.0, 9.1.0, and 9.2.0 could disclose sensitive information to a local attacker due to improper permission settings. IBM X-Force ID: 134638.
CVE-2021-20349, published 2021-08-09. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Tivoli Workload Scheduler 9.4 and 9.5 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a buffer and gain lower level privileges.…