IBM WebSphere Portal vulnerabilities

126 CVEs affecting IBM WebSphere Portal, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1673, published 2018-10-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-0679, published 2011-01-28. Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days. IBM WebSphere Portal 6.0.1.1 through 7.0.0.0, as used in IBM Lotus Web Content Management (WCM) and IBM Lotus Quickr for WebSphere Portal, allows remote attackers to obtain sensitive information via…
CVE-2013-6735, published 2013-12-22. Medium severity, CVSS 5.0. EPSS: 3.6% chance of exploitation in the next 30 days. IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08…
CVE-2010-0714, published 2010-02-26. Medium severity, CVSS 4.3. EPSS: 3.5% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0…
CVE-2015-1886, published 2015-04-27. High severity, CVSS 7.8. EPSS: 3.4% chance of exploitation in the next 30 days. The Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through…
CVE-2015-7419, published 2015-11-14. High severity, CVSS 7.8. EPSS: 3.2% chance of exploitation in the next 30 days. IBM WebSphere Portal 8.0.0.1 before CF19 and 8.5.0 before CF09 allows remote attackers to cause a denial of service (memory consumption) via crafted requests.
CVE-2012-4834, published 2012-11-30. Medium severity, CVSS 5.0. EPSS: 3.1% chance of exploitation in the next 30 days. Directory traversal vulnerability in LayerLoader.jsp in the theme component in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF19 and 8.0 before CF03 allows remote attackers to read arbitrary files…
CVE-2007-3127, published 2007-06-19. Medium severity, CVSS 5.0. EPSS: 3% chance of exploitation in the next 30 days. content.php in WSPortal 1.0, when magic_quotes_gpc is disabled, allows remote attackers to obtain sensitive information via a "';" (quote semicolon) sequence in the page parameter, which reveals the…
CVE-2017-1577, published 2017-09-28. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences…
CVE-2012-2181, published 2012-07-03. Medium severity, CVSS 5.0. EPSS: 2.8% chance of exploitation in the next 30 days. Directory traversal vulnerability in the Dojo module in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF14, and 8.0, allows remote attackers to read arbitrary files via a crafted URL.
CVE-2015-1943, published 2015-09-14. High severity, CVSS 7.8. EPSS: 2.7% chance of exploitation in the next 30 days. IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to cause a denial…

Latest

CVE-2018-1673, published 2018-10-12. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2018-1672, published 2018-10-01. Medium severity, CVSS 6.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user. IBM…
CVE-2018-1420, published 2018-10-01. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fix (CF) installation. This can lead to security…
CVE-2018-1820, published 2018-09-27. Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days. IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2018-1736, published 2018-09-27. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a…
CVE-2018-1716, published 2018-09-27. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2018-1660, published 2018-09-27. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2013-2951, published 2018-07-11. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM WebSphere Portal 7.0.0.x and 8.0.0.x write passwords to a trace file when tracing is enabled for the Selfcare Portlet (Profile Management), which allows local users to obtain sensitive…
CVE-2018-1445, published 2018-04-17. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM WebSphere Portal 8.0.0 through 8.0.0.1, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the…
CVE-2018-1483, published 2018-04-11. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…