CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-38330 – IBM i privilege escalation
https://notcve.org/view.php?id=CVE-2024-38330
IBM System Management for i 7.2, 7.3, and 7.4 could allow a local user to gain elevated privileges due to an unqualified library program call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 295227. IBM System Management para i 7.2, 7.3 y 7.4 podría permitir que un usuario local obtenga privilegios elevados debido a una llamada no calificada a un programa de librería. Un actor malintencionado podría provocar que el código controlado por el usuario se ejecute con privilegios de administrador. • https://exchange.xforce.ibmcloud.com/vulnerabilities/295227 https://www.ibm.com/support/pages/node/7159615 • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2024-31878 – IBM i information disclosure
https://notcve.org/view.php?id=CVE-2024-31878
IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can be used by a malicious actor to gather information about SST users that can be targeted in further attacks. IBM X-Force ID: 287538. IBM i 7.2, 7.3, 7.4 y 7.5 Service Tools Server (SST) es vulnerable a la enumeración de usuarios de SST por parte de un atacante remoto. Esta vulnerabilidad puede ser utilizada por un actor malintencionado para recopilar información sobre los usuarios de SST que puede ser objeto de futuros ataques. • https://exchange.xforce.ibmcloud.com/vulnerabilities/287538 https://www.ibm.com/support/pages/node/7156725 • CWE-203: Observable Discrepancy •
CVSS: 8.4EPSS: 0%CPEs: 4EXPL: 0CVE-2024-22346 – IBM i privilege escalation
https://notcve.org/view.php?id=CVE-2024-22346
Db2 for IBM i 7.2, 7.3, 7.4, and 7.5 infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 280203. Db2 para la infraestructura IBM i 7.2, 7.3, 7.4 y 7.5 podría permitir que un usuario local obtenga privilegios elevados debido a una llamada de biblioteca no calificada. Un actor malintencionado podría provocar que el código controlado por el usuario se ejecute con privilegios de administrador. • https://exchange.xforce.ibmcloud.com/vulnerabilities/280203 https://www.ibm.com/support/pages/node/7140499 • CWE-264: Permissions, Privileges, and Access Controls CWE-427: Uncontrolled Search Path Element •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2024-22318 – IBM i Access Client Solutions information disclosure
https://notcve.org/view.php?id=CVE-2024-22318
IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user's session. The hostile server could capture the NTLM hash information to obtain the user's credentials. IBM X-Force ID: 279091. IBM i Access Client Solutions (ACS) 1.1.2 a 1.1.4 y 1.1.4.3 a 1.1.9.4 es vulnerable a la divulgación de hash de NT LAN Manager (NTLM) por parte de un atacante que modifica rutas con capacidad UNC dentro de los ACS archivos de configuración para apuntar a un servidor hostil. • https://www.exploit-db.com/exploits/51817 http://packetstormsecurity.com/files/177069/IBM-i-Access-Client-Solutions-Remote-Credential-Theft.html http://seclists.org/fulldisclosure/2024/Feb/7 https://exchange.xforce.ibmcloud.com/vulnerabilities/279091 https://www.ibm.com/support/pages/node/7116091 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-384: Session Fixation •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-43064 – IBM i code execution
https://notcve.org/view.php?id=CVE-2023-43064
Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause arbitrary code to run with the privilege of the user invoking the facsimile support. IBM X-Force ID: 267689. Facsimile Support para IBM i 7.2, 7.3, 7.4 y 7.5 podría permitir que un usuario local obtenga privilegios elevados debido a una llamada de librería no calificada. Un actor malintencionado podría provocar que se ejecutara código arbitrario con el privilegio del usuario que invoca el soporte de fax. • https://exchange.xforce.ibmcloud.com/vulnerabilities/267689 https://www.ibm.com/support/pages/node/7101330 • CWE-427: Uncontrolled Search Path Element •