CVE-2015-4939

IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management XSS via Crafted URL

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21966754

Scores

EPSS 0.0096
EPSS Percentile 57.9%

Details

CWE
CWE-79
Status published
Products (46)
ibm/emptoris_program_management 10.0.0.0
ibm/emptoris_program_management 10.0.0.1
ibm/emptoris_program_management 10.0.0.2
ibm/emptoris_program_management 10.0.0.3
ibm/emptoris_program_management 10.0.1.0
ibm/emptoris_program_management 10.0.1.1
ibm/emptoris_program_management 10.0.1.2
ibm/emptoris_program_management 10.0.1.3
ibm/emptoris_program_management 10.0.1.4
ibm/emptoris_program_management 10.0.2.0
... and 36 more
Published Oct 06, 2015
Tracked Since Feb 18, 2026