CVSS: 5.3EPSS: 0%CPEs: 13EXPL: 0CVE-2020-10693 – hibernate-validator: Improper input validation in the interpolation of constraint error messages
https://notcve.org/view.php?id=CVE-2020-10693
06 May 2020 — A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages. Se encontró un fallo en Hibernate Validator versión 6.1.2.Final. Un error en el procesador de interpolación de mensajes permite evaluar expresiones EL no válid... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10693 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-4720
https://notcve.org/view.php?id=CVE-2019-4720
31 Jan 2020 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available memory. IBM X-Force ID: 172125. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0, es vulnerable a una denegación de servicio, causada mediante el envío de una petición especialmente diseñada. Un atacante remoto podría explotar esta vulnerabilidad para causar qu... • https://exchange.xforce.ibmcloud.com/vulnerabilities/172125 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-4305
https://notcve.org/view.php?id=CVE-2019-4305
30 Sep 2019 — IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951. IBM WebSphere Application Server Liberty, podría permitir a un atacante remoto obtener información confidencial causada por la configuración inapropiada de una cookie. ID de IBM X-Force: 160951. • https://exchange.xforce.ibmcloud.com/vulnerabilities/160951 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-4304
https://notcve.org/view.php?id=CVE-2019-4304
30 Sep 2019 — IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM X-Force ID: 160950. IBM WebSphere Application Server - Liberty, podría permitir a un atacante remoto omitir las restricciones de seguridad causadas por una comprobación de sesión inapropiada. ID de IBM X-Force: 160950. • https://exchange.xforce.ibmcloud.com/vulnerabilities/160950 • CWE-384: Session Fixation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-4046
https://notcve.org/view.php?id=CVE-2019-4046
25 Mar 2019 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker could exploit this vulnerability to cause the consumption of Memory. IBM X-Force ID: 156242. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 es vulnerable a denegaciones de servicio causadas por una gestión inadecuada de las cabeceras de peticiones. Un atacante remoto podría explotar esta vulnerabilidad para provocar un consumo de memoria. • http://www.securityfocus.com/bid/107623 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-1902
https://notcve.org/view.php?id=CVE-2018-1902
11 Mar 2019 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. IBM X-Force ID: 152531. IBM WebSphere Application Server, en versiones 7.0, 8.0, 8.5 y 9.0, podría permitir a un atacante remoto suplantar la información de conexión, la cual podría emplearse para lanzar otros ataques contra el sistema. IBM X-Force ID: 152531. • http://www.securityfocus.com/bid/107383 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2018-1851
https://notcve.org/view.php?id=CVE-2018-1851
31 Oct 2018 — IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted request to the RP service, an attacker could exploit this vulnerability to execute arbitrary code. IBM X-Force ID: 150999. IBM WebSphere Application Server Liberty OpenID Connect podría permitir que un atacante remoto ejecute código arbitrario en el sistema, provocado por una deserialización incorrecta. Un atacante p... • http://www.securityfocus.com/bid/105839 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1683
https://notcve.org/view.php?id=CVE-2018-1683
26 Sep 2018 — IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB communication. IBM X-Force ID: 145455. IBM WebSphere Application Server Liberty podría permitir que un atacante remoto obtenga información sensible, provocado por la imposibilidad de cifrar las comunicaciones ORB. IBM X-Force ID: 145455. • http://www.securitytracker.com/id/1041720 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1553
https://notcve.org/view.php?id=CVE-2018-1553
27 Jun 2018 — IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptions by the SAML Web SSO feature. IBM X-Force ID: 142890. IBM WebSphere Application Server Liberty en versiones anteriores a la 18.0.0.2 podría permitir que un atacante remoto obtenga información sensible. Esto viene provocado por la gestión incorrecta de excepciones por parte de la característica SAML Web SSO. IBM X-Force ID: 142890. • http://www.ibm.com/support/docview.wss?uid=swg22016218 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-0378
https://notcve.org/view.php?id=CVE-2016-0378
24 Nov 2016 — IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception. IBM WebSphere Application Server (WAS) Liberty en versiones anteriores a 16.0.0.3, cuando la instalación carece de una página de error predeterminada, permite a atacantes remotos obtener información sensible desencadenando una excepción. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI54459 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •