CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-28781 – IBM UrbanCode Deploy cross-site scripting
https://notcve.org/view.php?id=CVE-2024-28781
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4, and 8.0 through 8.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 285654. IBM UrbanCode Deploy (UCD) 7.0 a 7.0.5.20, 7.1 a 7.1.2.16, 7.2 a 7.2.3.9, 7.3 a 7.3.2.4 y 8.0 a 8.0.0.1 es vulnerable a Cross Site Scripting. Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista, lo que podría conducir a la divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/285654 https://www.ibm.com/support/pages/node/7150747 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.3EPSS: 0%CPEs: 5EXPL: 0CVE-2024-22358 – IBM UrbanCode Deploy session fixation
https://notcve.org/view.php?id=CVE-2024-22358
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 280896. IBM UrbanCode Deploy (UCD) 7.0 a 7.0.5.20, 7.1 a 7.1.2.16, 7.2 a 7.2.3.9, 7.3 a 7.3.2.4 e IBM DevOps Deploy 8.0 a 8.0.0.1 no invalida la sesión después del cierre de sesión, lo que podría permitir un usuario autenticado para hacerse pasar por otro usuario en el sistema. ID de IBM X-Force: 280896. • https://exchange.xforce.ibmcloud.com/vulnerabilities/280896 https://www.ibm.com/support/pages/node/7148109 • CWE-613: Insufficient Session Expiration •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2024-22339 – IBM UrbanCode Deploy information disclosure
https://notcve.org/view.php?id=CVE-2024-22339
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 is vulnerable to a sensitive information due to insufficient obfuscation of sensitive values from some log files. IBM X-Force ID: 279979. IBM UrbanCode Deploy (UCD) 7.0 a 7.0.5.20, 7.1 a 7.1.2.16, 7.2 a 7.2.3.9, 7.3 a 7.3.2.4 e IBM DevOps Deploy 8.0 a 8.0.0.1 es vulnerable a información confidencial debido a una ofuscación insuficiente de la información confidencial. valores de algunos archivos de registro. ID de IBM X-Force: 279979. • https://exchange.xforce.ibmcloud.com/vulnerabilities/279979 https://www.ibm.com/support/pages/node/7148113 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.4EPSS: 0%CPEs: 5EXPL: 0CVE-2024-22334 – IBM UrbanCode Deploy improper privilege control
https://notcve.org/view.php?id=CVE-2024-22334
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type. When deleting a custom security type, associated permissions of objects using that type may not be fully revoked. This could lead to incorrect reporting of permission configuration and unexpected privileges being retained. IBM X-Force ID: 279974. IBM UrbanCode Deploy (UCD) 7.0 a 7.0.5.20, 7.1 a 7.1.2.16, 7.2 a 7.2.3.9, 7.3 a 7.3.2.4 e IBM DevOps Deploy 8.0 a 8.0.0.1 podrían ser vulnerables a una revocación incompleta de permisos al eliminar un tipo de recurso de seguridad. • https://exchange.xforce.ibmcloud.com/vulnerabilities/279974 https://www.ibm.com/support/pages/node/7148112 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2024-22359 – IBM UrbanCode Deploy cross-site scripting
https://notcve.org/view.php?id=CVE-2024-22359
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 280897. IBM UrbanCode Deploy (UCD) 7.0 a 7.0.5.20, 7.1 a 7.1.2.16, 7.2 a 7.2.3.9, 7.3 a 7.3.2.4 e IBM DevOps Deploy 8.0 a 8.0.0.1 son vulnerables a cross-site scripting. Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista, lo que podría conducir a la divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/280897 https://www.ibm.com/support/pages/node/7148111 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •