16 results (0.003 seconds)

CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2023-35890 – IBM WebSphere Application Server information disclosure

https://notcve.org/view.php?id=CVE-2023-35890

IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X-Force ID: 258637. IBM WebSphere Application Server v8.5 y v9.0 podrían proporcionar una seguridad más débil de lo esperado, causada por la codificación incorrecta en un archivo de configuración local. ID de IBM X-Force: 258637. • https://https://www.ibm.com/support/pages/node/7007857 https://www.ibm.com/support/pages/node/7007857 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •

CVSS: 5.4EPSS: 0%CPEs: 13EXPL: 0

CVE-2022-34165

https://notcve.org/view.php?id=CVE-2022-34165

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by improper validation. This could allow an attacker to conduct various attacks against the vulnerable system, including cache poisoning and cross-site scripting. IBM X-Force ID: 229429. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0 e IBM WebSphere Application Server Liberty versiones 17.0.0.3 a 22.0.0.9 son vulnerables a una inyección de encabezados HTTP, causada por una comprobación inapropiada. Esto podría permitir a un atacante conducir varios ataques contra el sistema vulnerable, incluyendo el envenenamiento de la caché y ataques de tipo cross-site scripting. • https://exchange.xforce.ibmcloud.com/vulnerabilities/229429 https://www.ibm.com/support/pages/node/6618747 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •

CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0

CVE-2021-39038

https://notcve.org/view.php?id=CVE-2021-39038

IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 213968. IBM WebSphere Application Server versión 9.0 e IBM WebSphere Application Server Liberty versiones 17.0.0.3 hasta 22.0.0.2, podrían permitir a un atacante remoto secuestrar la acción de hacer clic de la víctima. Al persuadir a una víctima para que visite un sitio web malicioso, un atacante remoto podría explotar esta vulnerabilidad para secuestrar las acciones de clic de la víctima y posiblemente lanzar más ataques contra ella. • https://exchange.xforce.ibmcloud.com/vulnerabilities/213968 https://www.ibm.com/support/pages/node/6559044 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •

CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0

CVE-2021-29842

https://notcve.org/view.php?id=CVE-2021-29842

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5, 9.0 y Liberty versiones 17.0.0.3 hasta 21.0.0.9, podrían permitir a un usuario remoto enumerar nombres de usuario debido a una diferencia de respuestas de intentos de inicio de sesión válidos y no válidos. IBM X-Force ID: 205202 • https://exchange.xforce.ibmcloud.com/vulnerabilities/205202 https://www.ibm.com/support/pages/node/6489485 • CWE-307: Improper Restriction of Excessive Authentication Attempts •

CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 0

CVE-2021-20492

https://notcve.org/view.php?id=CVE-2021-20492

IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 197793. IBM WebSphere Application Server versiones 8.0, 8.5, 9.0 y Liberty Java Batch es vulnerable a un ataque de tipo XML External Entity Injection (XXE) cuando procesa datos XML. Un atacante remoto podría explotar esta vulnerabilidad para exponer información confidencial o consumir recursos de memoria. • https://exchange.xforce.ibmcloud.com/vulnerabilities/197793 https://www.ibm.com/support/pages/node/6456017 • CWE-611: Improper Restriction of XML External Entity Reference •