Ibm Curam Social Program Management vulnerabilities

CVE-2014-8903 [HIGH] CWE-77 CVE-2014-8903: IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrary Java classes via unspecified vectors.

CVE-2020-4776 [HIGH] CWE-22 CVE-2020-4776: A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, whic A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted file path in URL request to view arbitrary files on the system. IBM X-Force ID: 189154.

CVE-2016-6111 [CRITICAL] CWE-611 CVE-2016-6111: IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000833.

CVE-2020-4779 [HIGH] CWE-287 CVE-2020-4779: A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass security access controls. IBM X-Force ID: 189156.

CVE-2020-4772 [HIGH] CWE-611 CVE-2020-4772: An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management An XML External Entity Injection (XXE) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. A remote attacker could exploit this vulnerability to expose sensitive information, denial of service, server side request forgery or consume memory resources. IBM X-Force ID: 189150.

CVE-2022-22318 [CRITICAL] CWE-613 CVE-2022-22318: IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which c IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

CVE-2022-22317 [CRITICAL] CWE-613 CVE-2022-22317: IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which c IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 218281.

CVE-2020-4942 [HIGH] CWE-352 CVE-2020-4942: IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery whi IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191942.

CVE-2020-4778 [HIGH] CWE-327 CVE-2020-4778: IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a singl IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the Cúram application. IBM X-Force ID: 189156.

CVE-2018-2001 [HIGH] CWE-352 CVE-2018-2001: IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site reques IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154891.

CVE-2015-5023 [MEDIUM] CWE-89 CVE-2015-5023: SQL injection vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1 allows remote au SQL injection vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

CVE-2020-4781 [MEDIUM] CWE-20 CVE-2020-4781: An improper input validation before calling java readLine() method may impact IBM Curam Social Progr An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could result in a denial of service. IBM X-Force ID: 189159.

CVE-2017-1110 [MEDIUM] CWE-200 CVE-2017-1110: IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability tha IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to view the incidents of a higher privileged user. IBM X-Force ID: 120915.

CVE-2020-4774 [MEDIUM] CWE-91 CVE-2020-4774: An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by th An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obtain unauthorized access or reveal sensitive information such as XML document structure and content. IBM X-Force ID:

CVE-2020-4773 [MEDIUM] CWE-352 CVE-2020-4773: A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0 A cross-site request forgery (CSRF) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which is an attack that forces a user to execute unwanted actions on the web application while they are currently authenticated. This applies to a single server class only, with no impact to remainder of web application. IBM X-Force ID: 1

CVE-2018-1671 [MEDIUM] CWE-79 CVE-2018-1671: IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could i IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-force ID: 144951.

CVE-2014-6090 [MEDIUM] CWE-352 CVE-2014-6090: Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix10, and 6.0.5 before 6.0.5.6 allow remote attackers t

CVE-2014-4843 [MEDIUM] CWE-358 CVE-2014-4843: Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 befor Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.

CVE-2018-1654 [MEDIUM] CWE-601 CVE-2018-1654: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attac IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that w

CVE-2017-1195 [MEDIUM] CWE-601 CVE-2017-1195: IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to b