IBM Urbancode Velocity vulnerabilities

3 CVEs affecting IBM Urbancode Velocity, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-22349, published 2025-01-20.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-22348, published 2025-01-20. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve…
• CVE-2024-22347, published 2025-01-20. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
• CVE-2024-22349, published 2025-01-20. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.