CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3088 – IBM Sametime Meet Server 8.5 Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2014-3088
stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-data POST requests, which allows remote authenticated users to bypass intended upload restrictions by modifying the Content-Type header and file extension, as demonstrated by replacing a text/plain .txt upload with an application/octet-stream .exe upload. stconf.nsf en IBM Sametime Meeting Server 8.5.1 depende del cliente para validar el formato de fichero utilizado en solicitudes wAttach?OpenForm multipart/form-data POST, lo que permite a usuarios remotos autenticados evadir restricciones de subida mediante la modificación la cabera de tipo de contenido y extensión de fichero, tal y como fue demostrado mediante la sustitución de una subida text/plain .txt por una subida application/octet-stream .exe. IBM Sametime Meet Server version 8.8 suffers from a remote arbitrary file upload vulnerability. • http://linux.oracle.com/errata/ELSA-2014-0747.html http://packetstormsecurity.com/files/127294 http://packetstormsecurity.com/files/127829/IBM-Sametime-Meet-Server-8.5-Arbitrary-File-Upload.html http://www.securityfocus.com/bid/68291 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 17EXPL: 0CVE-2013-0535
https://notcve.org/view.php?id=CVE-2013-0535
Multiple cross-site scripting (XSS) vulnerabilities in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en Classic Meeting Server en IBM Sametime v7.5.1.2 hasta v8.5.2.1 que permite a usuarios autenticados inyectar secuencias arbitrarias de comandos web o HTML a través de vectores sin especificar. • http://www-01.ibm.com/support/docview.wss?uid=swg21635185 http://www-01.ibm.com/support/docview.wss?uid=swg21635545 https://exchange.xforce.ibmcloud.com/vulnerabilities/82657 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •