Ibm Curam Social Program Management vulnerabilities
46 known vulnerabilities affecting ibm/curam_social_program_management.
Total CVEs
46
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL3HIGH7MEDIUM29LOW7
Vulnerabilities
Page 2 of 3
CVE-2016-0261P4MEDIUMCVSS 5.4≥ 6.0.4.0, ≤ 6.0.4.6≥ 6.0.5.0, ≤ 6.0.5.9+6 more2018-03-12
CVE-2016-0261 [MEDIUM] CWE-79 CVE-2016-0261: Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP2
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 before 6.0.5.9 iFix2, 6.1.0 before 6.1.0.1 iFix1, and 6.1.1 before 6.1.1.1 iFix1; and IBM Care Management 6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110
nvd
CVE-2020-4780P4MEDIUMCVSS 5.3v7.0.9.0v7.0.10.02020-10-12
CVE-2020-4780 [MEDIUM] CWE-613 CVE-2020-4780: OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam So
OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158.
nvd
CVE-2020-4775P4MEDIUMCVSS 5.4v7.0.9.0v7.0.10.02020-10-12
CVE-2020-4775 [MEDIUM] CWE-79 CVE-2020-4775: A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and
A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user's device, restricted to a single location. IBM X-Force ID: 189153.
nvd
CVE-2021-39068P4MEDIUMCVSS 5.4v7.0.11.0v8.0.1+1 more2022-04-11
CVE-2021-39068 [MEDIUM] CWE-79 CVE-2021-39068: IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting. This vul
IBM Curam Social Program Management 8.0.1 and 7.0.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 215306.
nvd
CVE-2018-1362P4MEDIUMCVSS 5.0v6.0.5v6.1.1.0+2 more2018-01-19
CVE-2018-1362 [MEDIUM] CVE-2018-1362: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw other user's submitted applications from the system and possibly obtain privileges. IBM X-Force ID: 137380.
nvd
CVE-2018-1900P4MEDIUMCVSS 5.4≥ 6.0.5.0, ≤ 6.0.5.10≥ 6.1.0.0, ≤ 6.1.1.6+8 more2018-12-11
CVE-2018-1900 [MEDIUM] CWE-79 CVE-2018-1900: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-sit
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152529.
nvd
CVE-2017-1740P4MEDIUMCVSS 5.4v6.0.5v6.0.5.0+36 more2018-01-11
CVE-2017-1740 [MEDIUM] CWE-79 CVE-2017-1740: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.2 is vulnerable to cross-sit
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134922.
nvd
CVE-2017-1739P4MEDIUMCVSS 5.4v6.0.5.0v6.0.5.1+34 more2018-01-11
CVE-2017-1739 [MEDIUM] CWE-79 CVE-2017-1739: IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 is vulnerable to cross-site scrip
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134921.
nvd
CVE-2017-1106P4MEDIUMCVSS 5.4v5.2v6.0+40 more2017-06-28
CVE-2017-1106 [MEDIUM] CWE-79 CVE-2017-1106: IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vu
IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120744.
nvd
CVE-2016-9980P4MEDIUMCVSS 5.4v5.2v6.0+35 more2017-04-20
CVE-2016-9980 [MEDIUM] CWE-79 CVE-2016-9980: IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vu
IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120256.
nvd
CVE-2016-9732P4MEDIUMCVSS 5.4v6.0.4.0v6.0.4.1+37 more2017-08-29
CVE-2016-9732 [MEDIUM] CWE-79 CVE-2016-9732: IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. Thi
IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119761.
nvd
CVE-2016-9979P4MEDIUMCVSS 5.4v6.0.4.0v6.0.4.1+32 more2017-04-20
CVE-2016-9979 [MEDIUM] CWE-79 CVE-2016-9979: IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vu
IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120255.
nvd
CVE-2014-6191P4MEDIUMCVSS 5.4v6.0v6.0.4.0+11 more2017-09-19
CVE-2014-6191 [MEDIUM] CWE-79 CVE-2014-6191: Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 98568.
nvd
CVE-2015-7402P4MEDIUMCVSS 5.4v6.12016-01-02
CVE-2015-7402 [MEDIUM] CWE-79 CVE-2015-7402: Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1.1 a
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
nvd
CVE-2014-6092P4MEDIUMCVSS 5.0≤ 5.2v6.0.4.0+11 more2015-04-27
CVE-2014-6092 [MEDIUM] CWE-17 CVE-2014-6092: IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause a denial of service (web-service outage) by making ma
nvd
CVE-2015-7401P4MEDIUMCVSS 4.3≥ 6.1.0.0, < 6.1.1.12018-03-26
CVE-2015-7401 [MEDIUM] CWE-200 CVE-2015-7401: IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass
IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive document information by guessing the document id. IBM X-Force ID: 107106.
nvd
CVE-2014-4804P4MEDIUMCVSS 4.3≤ 5.2v6.0+3 more2015-02-14
CVE-2014-4804 [MEDIUM] CWE-200 CVE-2014-4804: Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP2
Curam Universal Access in IBM Curam Social Program Management 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4.5 before iFix007, 6.0.5.4 before iFix005, and 6.0.5.5 before iFix003, when SPI inclusion is enabled, allows remote attackers to obtain sensitive user data by visiting an unspecified page.
nvd
CVE-2016-8923P4MEDIUMCVSS 4.3v5.2v6.0+35 more2017-04-20
CVE-2016-8923 [MEDIUM] CWE-200 CVE-2016-8923: IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an a
IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive information from the profile of a higher privileged user that they should not have access to. IBM X-Force ID: 118536.
nvd
CVE-2016-9978P4MEDIUMCVSS 4.3v5.2v6.0+35 more2017-04-20
CVE-2016-9978 [MEDIUM] CWE-200 CVE-2016-9978: IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to discl
IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information. IBM X-Force ID: 120254.
nvd
CVE-2014-4803P4LOWCVSS 3.5≤ 6.0v6.0.4.0+11 more2015-02-13
CVE-2014-4803 [LOW] CVE-2014-4803: CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Mana
CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via an unspeci
nvd