IBM Tririga Application Platform vulnerabilities

50 CVEs affecting IBM Tririga Application Platform, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93892, published 2026-10-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-4840, published 2014-10-19. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL.
CVE-2017-1373, published 2017-07-21. High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days. Reports executed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user to execute a report they do not have access to. IBM X-Force…
CVE-2019-4208, published 2019-05-07. High severity, CVSS 7.1. EPSS: 1.9% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose…
CVE-2016-0299, published 2018-02-28. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote attackers to obtain sensitive information via vectors involving a database query. IBM…
CVE-2016-0312, published 2018-02-02. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform before 3.3.2 allows remote attackers to obtain sensitive information via vectors related to granting unauthenticated access to Document Manager. IBM X-Force ID:…
CVE-2020-4277, published 2020-04-17. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-Force ID: 175993.
CVE-2018-2008, published 2019-05-07. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further attacks against the system. IBM X-Force ID: 155146.
CVE-2017-1371, published 2017-07-21. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user to execute Builder tool actions they do not have access…
CVE-2017-1153, published 2017-03-27. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. IBM TRIRIGA Report Manager 3.2 through 3.5 contains a vulnerability that could allow an authenticated user to execute actions that they do not have access to. IBM Reference #: 1999563.
CVE-2016-2917, published 2016-11-30. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. The notifications component in IBM TRIRIGA Applications 10.4 and 10.5 before 10.5.1 allows remote authenticated users to obtain sensitive password information, and consequently gain privileges, via…

Latest

CVE-2026-93892, published 2026-10-12. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.
CVE-2026-93891, published 2026-10-12. High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
CVE-2026-102627, published 2026-10-12. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction.
CVE-2026-11372, published 2026-06-22. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus…
CVE-2020-4868, published 2023-07-31. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2023-27876, published 2023-04-07. High severity, CVSS 7.1. EPSS: 1.1% chance of exploitation in the next 30 days. IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume…
CVE-2022-43914, published 2023-04-07. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2019-4207, published 2019-05-07. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in further attacks against the system. IBM X-Force ID: 159148.