CVE-2014-0867

IBM Algorithmics <4.7.0.03 FP5 - XSS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-0867.

AI-analyzed exploit summary This is a detailed security advisory from SEC Consult Vulnerability Lab describing multiple vulnerabilities in IBM Algorithmics RICOS, including information disclosure, password disclosure, XSS, broken encryption, and CSRF. It provides technical details, proof-of-concept examples, and affected versions.

Description

rcore6/main/addcookie.jsp in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows remote attackers to create or modify cookies via the query string.

Exploits (1)

exploitdb WRITEUP
webappsjsp
https://www.exploit-db.com/exploits/33942

This is a detailed security advisory from SEC Consult Vulnerability Lab describing multiple vulnerabilities in IBM Algorithmics RICOS, including information disclosure, password disclosure, XSS, broken encryption, and CSRF. It provides technical details, proof-of-concept examples, and affected versions.

Classification
Writeup 100%
Attack Type
Info Leak | Auth Bypass | Xss | Other
Complexity
Moderate
Reliability
Reliable
Target: IBM Algorithmics RICOS 4.5.0 - 4.7.0
No auth needed
Prerequisites: Access to the target application · Network access to the server
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/90941
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/532598/100/0/threaded
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21675881
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Jun/173

Scores

EPSS 0.0507
EPSS Percentile 91.2%

Details

Status published
Products (3)
ibm/algo_credit_limits 4.5.0
ibm/algo_credit_limits 4.7.0
ibm/algorithmics
Published Jul 07, 2014
Tracked Since Feb 18, 2026