CVE-2014-4790: IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, a...

Security readout for executives and security teams

This CVE affects legacy IBM Emptoris procurement analytics products. The applications did not properly restrict framing, allowing an authenticated attacker to use a crafted website for phishing, access-control bypass, or sensitive information exposure. The public bundle does not provide CVSS scoring or active exploitation evidence. Exposure is likely limited to organizations still running the named IBM Emptoris Sourcing Portfolio or Spend Analysis versions. Risk depends on authenticated user access and whether vulnerable web interfaces are reachable by users who can be lured to attacker-controlled content. Prioritize remediation if these legacy IBM Emptoris products remain in use, especially where business users access them through browsers. The issue is not reported as actively exploited, but it can support phishing and sensitive information exposure. Mitigation focus: Upgrade affected Emptoris Sourcing Portfolio versions to the listed fixed releases or later.; Upgrade affected Emptoris Spend Analysis versions to the listed fixed releases or later.; Review IBM support advisories for product-specific remediation guidance..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.