CVE-2015-7398
MEDIUMIBM Emptoris Contract Management - XSS
Title source: ruleDescription
Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Scores
CVSS v3
5.4
EPSS
0.0017
EPSS Percentile
37.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Classification
CWE
CWE-79
Status
draft
Affected Products (24)
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
ibm/emptoris_contract_management
... and 9 more
Timeline
Published
Feb 15, 2016
Tracked Since
Feb 18, 2026