CVE-2015-4939
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
06/10/2015
Last modified:
12/04/2025
Description
Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Impact
Base Score 2.0
4.30
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:ibm:emptoris_program_management:10.0.0.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.0.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.0.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.0.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.1.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.1.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.1.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.1.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.1.4:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.2.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.2.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.2.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.2.4:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.2.5:*:*:*:*:*:*:* | ||
| cpe:2.3:a:ibm:emptoris_program_management:10.0.2.6:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page