CS
Product
Curam Social Program Management
46
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 26Low 0
Watch
Add Curam Social Program Management to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22318 | 9.8 | Jun 20 | IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system Affected: 8.0.0; 8.0.1 |
| CVE-2022-22317 | 9.8 | Jun 20 | IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system Affected: 8.0.0; 8.0.1 |
| CVE-2016-6111 | 9.1 | Mar 31 | IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data Affected: 5.2; 5.2; 5.2; 6.0; 6.0; 6.0.0; +33 more |
| CVE-2020-4942 | 8.8 | Jan 4 | IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… Affected: 7.0.9.0; 7.0.11.0 |
| CVE-2018-2001 | 8.8 | May 7 | IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… Affected: 6.1.0.0 through 6.1.1.6; 6.2.0.0 through 6.2.0.6; 7.0.0.0 through 7.0.4.0; 7.0.5.0 |
| CVE-2014-8903 | 8.8 | Aug 2 | IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrary Java classes via… Affected: 6.0; 6.0.4.0; 6.0.4.1; 6.0.4.2; 6.0.4.3; 6.0.4.4; +17 more |
| CVE-2020-4779 | 8.1 | Oct 12 | A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10 Affected: 7.0.9.0; 7.0.10.0 |
| CVE-2020-4772 | 8.1 | Oct 12 | An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10 Affected: 7.0.9.0; 7.0.10.0 |
| CVE-2020-4778 | 7.5 | Oct 12 | IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used… Affected: 7.0.9.0; 7.0.10.0 |
| CVE-2020-4776 | 7.5 | Oct 12 | A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remote attacker to traverse directories on the system Affected: 7.0.9.0; 7.0.10.0 |
| CVE-2020-4781 | 6.5 | Oct 12 | An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could result in a denial of service Affected: 7.0.9.0; 7.0.10.0 |
| CVE-2020-4773 | 6.5 | Oct 12 | A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to execute unwanted… Affected: 7.0.9.0; 7.0.10.0 |
| CVE-2017-1110 | 6.5 | Aug 28 | IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to view the incidents of a higher… Affected: 6.0.4.0; 6.0.4.1; 6.0.4.2; 6.0.4.3; 6.0.4.4; 6.0.4.5; +33 more |
| CVE-2018-1654 | 6.1 | Dec 11 | IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack Affected: 6.0.5; 6.1.1; 6.2.0; 7.0.1; 7.0.3 |
| CVE-2018-1671 | 6.1 | Dec 10 | IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection Affected: 7.0.3.0 |
| CVE-2017-1195 | 6.1 | Aug 29 | IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack Affected: 6.0.4.0; 6.0.4.1; 6.0.4.2; 6.0.4.3; 6.0.4.4; 6.0.4.5; +33 more |
| CVE-2021-39068 | 5.4 | Apr 11 | IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting Affected: 7.0.11; 8.0.1 |
| CVE-2020-4775 | 5.4 | Oct 12 | A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10 Affected: 7.0.9.0; 7.0.10.0 |
| CVE-2020-4774 | 5.4 | Oct 12 | An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input Affected: 7.0.9.0; 7.0.10.0 |
| CVE-2018-1900 | 5.4 | Dec 11 | IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting Affected: 6.0.5; 6.1.1; 6.2.0; 7.0.1; 7.0.4 |
| CVE-2016-0261 | 5.4 | Mar 12 | Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 before 6.0.5.9 iFix2, 6.1.0 before 6.1.0.1… Affected: 6.0.4.0 through 6.0.4.6; 6.0.5.0 through 6.0.5.9; 6.0; 6.0; 6.0.0; 6.1.0.0; +3 more |
| CVE-2017-1739 | 5.4 | Jan 11 | IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 is vulnerable to cross-site scripting Affected: 6.0.5.0; 6.0.5.1; 6.0.5.2; 6.0.5.3; 6.0.5.4; 6.0.5.5; +30 more |
| CVE-2017-1740 | 5.4 | Jan 11 | IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting Affected: 6.0.5; 6.0.5.0; 6.0.5.1; 6.0.5.2; 6.0.5.3; 6.0.5.4; +32 more |
| CVE-2014-6191 | 5.4 | Sep 19 | Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject arbitrary web script or HTML via… Affected: 6.0; 6.0.4.0; 6.0.4.1; 6.0.4.2; 6.0.4.3; 6.0.4.4; +7 more |
| CVE-2016-9732 | 5.4 | Aug 28 | IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting Affected: 6.0.4.0; 6.0.4.1; 6.0.4.2; 6.0.4.3; 6.0.4.4; 6.0.4.5; +33 more |
| CVE-2017-1106 | 5.4 | Jun 28 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting Affected: 5.2; 5.2; 5.2; 6.0; 6.0; 6.0.0; +34 more |
| CVE-2016-9980 | 5.4 | Apr 20 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting Affected: 6.0.4, 6.0.5, 6.0, 5.2, 4.5, 6.0.3, 6.1, 5.2.6, 6.0.1, 6.1.0, 6.1.1, 6.2.0, 7.0.0 |
| CVE-2016-9979 | 5.4 | Apr 20 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting Affected: 6.0.4, 6.0.5, 6.0, 5.2, 4.5, 6.0.3, 6.1, 5.2.6, 6.0.1, 6.1.0, 6.1.1, 6.2.0, 7.0.0 |
| CVE-2015-5023 | 5.4 | Jan 3 | SQL injection vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors Affected: 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +1 more |
| CVE-2015-7402 | 5.4 | Jan 2 | Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a… Affected: 6.1 |
| CVE-2020-4780 | 5.3 | Oct 12 | OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10 Affected: 7.0.9.0; 7.0.10.0 |
| CVE-2014-4843 | 5.3 | Jun 8 | Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain… Affected: 6.0; 6.0.4.0; 6.0.4.1; 6.0.4.2; 6.0.4.3; 6.0.4.4; +6 more |
| CVE-2018-1362 | 5.0 | Jan 19 | IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw other user's submitted applications from the… Affected: 6.0.5; 6.1.1.0; 6.2.0.0; 7.0.1 |
| CVE-2015-7401 | 4.3 | Mar 26 | IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive document information by… Affected: 6.1.0.0 before 6.1.1.1 |
| CVE-2016-9978 | 4.3 | Apr 20 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information Affected: 6.0.4, 6.0.5, 6.0, 5.2, 4.5, 6.0.3, 6.1, 5.2.6, 6.0.1, 6.1.0, 6.1.1, 6.2.0, 7.0.0 |
| CVE-2016-8923 | 4.3 | Apr 20 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive information from the profile of a higher… Affected: 6.0.4, 6.0.5, 6.0, 5.2, 4.5, 6.0.3, 6.1, 5.2.6, 6.0.1, 6.1.0, 6.1.1, 6.2.0, 7.0.0 |
| CVE-2014-6192 | – | May 25 | Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix10, 6.0.5 before 6.0.5.6, and 6.0.5.5a before 6.0.5.8… Affected: 6.0; 6.0.4.0; 6.0.4.1; 6.0.4.2; 6.0.4.3; 6.0.4.4; +10 more |
| CVE-2014-6092 | – | Apr 27 | IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service… Affected: through 5.2; 6.0.4.0; 6.0.4.1; 6.0.4.2; 6.0.4.3; 6.0.4.4; +7 more |
| CVE-2014-6090 | – | Apr 27 | Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam… Affected: 5.2; 6.0; 6.0.3.0; 6.0.4.0; 6.0.5.0 |
| CVE-2014-4804 | – | Feb 14 | Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003,… Affected: through 5.2; 6.0; 6.0.4.5; 6.0.5.4; 6.0.5.5 |
| CVE-2014-4803 | – | Feb 13 | CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before… Affected: through 6.0; 6.0.4.0; 6.0.4.1; 6.0.4.2; 6.0.4.3; 6.0.4.4; +7 more |
| CVE-2014-3096 | – | Jan 10 | Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management before 6.0.5.5a allows remote authenticated users to inject arbitrary web script or HTML via a… Affected: through 6.0.5.5 |
| CVE-2014-6091 | – | Sep 23 | Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management (SPM) 6.0.4 before 6.0.4.5 iFix7 allows remote authenticated users to inject arbitrary web script… Affected: 6.0.4.0; 6.0.4.1; 6.0.4.2; 6.0.4.3; 6.0.4.4; 6.0.4.5 |
| CVE-2014-3069 | – | Aug 12 | Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management (SPM) 6.0.5.5, when WebSphere Application Server is not used,… Affected: 6.0.5.5 |
| CVE-2014-3012 | – | Jun 18 | Multiple CRLF injection vulnerabilities in IBM Curam Social Program Management 5.2 SP1 through 6.0.5.4 allow remote authenticated users to inject arbitrary HTTP headers and… Affected: 5.2; 5.2; 6.0; 6.0.3.0; 6.0.4.0; 6.0.4.1; +9 more |
| CVE-2014-3013 | – | Jun 18 | Multiple cross-site scripting (XSS) vulnerabilities in IBM Curam Social Program Management 4.5 SP10 through 6.0.5.4 allow remote authenticated users to inject arbitrary web script… Affected: 4.5; 5.0; 5.2; 5.2; 6.0; 6.0.3.0; +11 more |
Showing 46