VulnerabilityModified
CVE-2014-0932
Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 before HF105 and Sterling Selling and Fulfillment Foundation 9.0 before HF85 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
LOW 3.5EPSS 0.95%
Does this matter?
Lower severity and a low EPSS score (0.95%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.5 before HF105 and Sterling Selling and Fulfillment Foundation 9.0 before HF85 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
- CVSS 2.0
- 3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
- EPSS
- 0.95% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- ibm/sterling order management · ibm/sterling selling and fulfillment foundation
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT00419
- http://www-01.ibm.com/support/docview.wss?uid=swg21670912Vendor Advisory
- http://www.securityfocus.com/bid/66993
- https://exchange.xforce.ibmcloud.com/vulnerabilities/92264
- http://www-01.ibm.com/support/docview.wss?uid=swg1IT00419
- http://www-01.ibm.com/support/docview.wss?uid=swg21670912Vendor Advisory
- http://www.securityfocus.com/bid/66993
- https://exchange.xforce.ibmcloud.com/vulnerabilities/92264
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.