IBM WebSphere Message Broker vulnerabilities

23 CVEs affecting IBM WebSphere Message Broker, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1801, published 2019-02-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-5372, published 2013-10-19. Medium severity, CVSS 4.3. EPSS: 2.8% chance of exploitation in the next 30 days. The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial…
CVE-2018-1801, published 2019-02-04. Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days. IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker V8.0.0.0 through V8.0.0.9…
CVE-2013-0482, published 2013-05-29. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when…
CVE-2015-7399, published 2016-01-11. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 before 10.0.0.0 allow remote attackers to obtain sensitive information about the…
CVE-2016-9706, published 2017-02-15. Critical severity, CVSS 9.1. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A…
CVE-2016-2961, published 2016-07-02. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows remote attackers to obtain sensitive Tomcat version…
CVE-2012-5952, published 2013-02-20. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2 does not validate Basic Authentication credentials before proceeding to WS-Addressing and WS-Security…
CVE-2014-6170, published 2015-02-02. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. The HTTPInput node in IBM WebSphere Message Broker 7.0 before 7.0.0.8 and 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.4 allows remote attackers to obtain sensitive information by…
CVE-2012-5953, published 2013-02-20. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2, when the Parse Query Strings option is enabled on an HTTPInput node, allows remote attackers to cause a…
CVE-2017-1126, published 2017-10-04. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that could lead to further attacks. IBM…

Latest

CVE-2017-1418, published 2018-11-26. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0.9) has insecure permissions on certain files. A local attacker could exploit…
CVE-2017-1144, published 2017-07-05. Low severity, CVSS 2.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM WebSphere Message Broker could allow a local user with specialized access to prevent the message broker from starting. IBM X-Force ID: 122033.
CVE-2017-1207, published 2017-07-05. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777.
CVE-2016-9010, published 2017-02-15. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could…
CVE-2016-6080, published 2017-02-01. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker.
CVE-2016-0394, published 2017-02-01. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files.