CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-32342 – IBM GSKit information disclosure
https://notcve.org/view.php?id=CVE-2023-32342
IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828. • https://exchange.xforce.ibmcloud.com/vulnerabilities/255828 • CWE-203: Observable Discrepancy •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2023-26281 – IBM HTTP Server denial of service
https://notcve.org/view.php?id=CVE-2023-26281
IBM HTTP Server 8.5 used by IBM WebSphere Application Server could allow a remote user to cause a denial of service using a specially crafted URL. IBM X-Force ID: 248296. • https://exchange.xforce.ibmcloud.com/vulnerabilities/248296 https://www.ibm.com/support/pages/node/6958522 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4947
https://notcve.org/view.php?id=CVE-2015-4947
Stack-based buffer overflow in the Administration Server in IBM HTTP Server 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7, as used in WebSphere Application Server and other products, allows remote authenticated users to execute arbitrary code via unspecified vectors. Desbordamiento del buffer basado en pila en el Administration Server en IBM HTTP Server 6.1.0.x hasta la versión 6.1.0.47, 7.0.0.x en versiones anteriores a 7.0.0.39, 8.0.0.x en versiones anteriores a 8.0.0.12 y 8.5.x en versiones anteriores a 8.5.5.7, tal como se utiliza en WebSphere Application Server y otros productos, permite a usuarios remotos autenticados ejecutar código arbitrario a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI44793 http://www-01.ibm.com/support/docview.wss?uid=swg1PI45596 http://www-01.ibm.com/support/docview.wss?uid=swg21965419 http://www.securityfocus.com/bid/76658 http://www.securitytracker.com/id/1033512 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 160EXPL: 0CVE-2015-2808 – SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher
https://notcve.org/view.php?id=CVE-2015-2808
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue. El algoritmo RC4, utilizado en el protocolo TLS y el protocolo SSL, no combina correctamente los datos de estados con los datos de claves durante la fase de inicialización, lo que facilita a atacantes remotos realizar ataques de recuperación de texto claro contra los bytes iniciales de un flujo mediante la captura de trafico de la red que ocasionalmente depende de claves afectadas por la debilidad de la invariabilidad (Invariance Weakness), y posteriormente utilizar un acercamiento de fuerza bruta que involucra valores LSB, también conocido como el problema de 'Bar Mitzvah'. • http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727 http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2012-5955
https://notcve.org/view.php?id=CVE-2012-5955
Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows remote attackers to execute arbitrary commands via unknown vectors. Vulnerabilidad no especificada en el componente de IBM HTTP Server v5.3 en IBM WebSphere Application Server (WAS) para z/OS permite a atacantes remotos ejecutar código arbitrario a través de vectores desconocidos. • http://www-01.ibm.com/support/docview.wss?&uid=swg21620945 https://exchange.xforce.ibmcloud.com/vulnerabilities/80684 •