IBM WebSphere Commerce vulnerabilities

43 CVEs affecting IBM WebSphere Commerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1808, published 2018-11-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-3298, published 2012-09-25. High severity, CVSS 10.0. EPSS: 2.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the REST services framework in IBM WebSphere Commerce 7.0 Feature Pack 4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of…
CVE-2014-0943, published 2014-05-25. High severity, CVSS 7.1. EPSS: 2.3% chance of exploitation in the next 30 days. IBM WebSphere Commerce 6.0 Feature Pack 2 through Feature Pack 5, 7.0.0.0 through 7.0.0.8, and 7.0 Feature Pack 1 through Feature Pack 7 allows remote attackers to cause a denial of service (resource…
CVE-2015-0133, published 2015-03-13. Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days. IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction…
CVE-2011-3577, published 2011-09-20. High severity, CVSS 10.0. EPSS: 2% chance of exploitation in the next 30 days. IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.3 does not properly implement Activity Token authentication for Web Services, which has unspecified impact and attack vectors.
CVE-2008-6973, published 2009-08-13. High severity, CVSS 10.0. EPSS: 2% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in IBM WebSphere Commerce 6.0 before 6.0.0.7 have unknown impact and attack vectors.
CVE-2016-6090, published 2017-02-01. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized administrative operations, and potentially causing a denial…
CVE-2015-7397, published 2016-01-10. High severity, CVSS 7.4. EPSS: 1.8% chance of exploitation in the next 30 days. Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8 allow remote attackers to redirect users to arbitrary web sites and conduct…
CVE-2017-1569, published 2017-10-03. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial of service. IBM X-Force ID: 131779.
CVE-2015-5008, published 2016-01-18. Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM WebSphere Commerce 6.0 through FP11, 6.0 Feature Pack 4, 7.0 through FP9, 7.0 Feature Pack 5 through 8, and 8.0 before 8.0.0.1 allows remote attackers…
CVE-2015-4980, published 2015-09-14. Medium severity, CVSS 4.0. EPSS: 1.6% chance of exploitation in the next 30 days. Unspecified vulnerability in IBM WebSphere Commerce 7.0.0.6 through 7.0.0.9 allows remote authenticated users to obtain sensitive personal information via unknown vectors.

Latest

CVE-2018-1808, published 2018-11-13. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828.
CVE-2018-1541, published 2018-10-24. Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days. IBM WebSphere Commerce Enterprise V7, V8, and V9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2018-1644, published 2018-08-27. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8…
CVE-2017-1484, published 2017-11-27. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attacker to obtain information such as user personal data. IBM X-Force ID: 128622.
CVE-2017-1398, published 2017-07-10. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 6.0, 7.0, and 8.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a…
CVE-2017-1170, published 2017-04-26. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local user to hijack a user's session. IBM X-Force ID: 123230.
CVE-2016-5894, published 2017-03-08. Medium severity, CVSS 5.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could view a plain text password in a Unix…
CVE-2016-2863, published 2016-07-03. High severity, CVSS 8.0. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 7.0 Feature Pack 8, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.2 allows remote authenticated users to hijack the…