CVSS: 4.0EPSS: 0%CPEs: 15EXPL: 0CVE-2014-6186
https://notcve.org/view.php?id=CVE-2014-6186
IBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x before 7.5.0.3, and 8.0.x before 8.0.0.1 allows remote authenticated users to bypass intended object-access restrictions via the datagraph. IBM WebSphere Service Registry y Repository (WSRR) 6.3.x anterior a 6.3.0.5, 7.0.x a través de 7.0.0.5, 7.5.x anterior a 7.5.0.3, y 8.0.x anterior a 8.0.0.1 permite a usuarios autenticados evadir las restricciones de acceso a objetos a través de datagraph. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV26309 http://www.ibm.com/support/docview.wss?uid=swg21693379 http://www.ibm.com/support/docview.wss?uid=swg21693381 http://www.ibm.com/support/docview.wss?uid=swg21693384 http://www.ibm.com/support/docview.wss? • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 21EXPL: 0CVE-2014-6153
https://notcve.org/view.php?id=CVE-2014-6153
The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. La interfaz de usuario web en IBM WebSphere Service Registry y Repository (WSRR) 6.3.x a través de 6.3.0.5, 7.0.x a través de7.0.0.5, 7.5.x a través de7.5.0.4, 8.0.x anterior a 8.0.0.3, y 8.5.x anterior a 8.5.0.1 no establece el indicador de seguridad en una cookie de sesión https, lo cual hace más fácil a atacantes remotos capturar dicha cookie interceptando la transmisión dentro de una sesión http. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV64010 http://www.ibm.com/support/docview.wss?uid=swg21693379 http://www.ibm.com/support/docview.wss?uid=swg21693381 http://www.ibm.com/support/docview.wss?uid=swg21693384 http://www.ibm.com/support/docview.wss? • CWE-310: Cryptographic Issues •
CVSS: 6.0EPSS: 0%CPEs: 15EXPL: 0CVE-2014-6187
https://notcve.org/view.php?id=CVE-2014-6187
Multiple cross-site request forgery (CSRF) vulnerabilities in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5, 7.0.x before 7.0.0.5, 7.5.x before 7.5.0.3, and 8.0.x before 8.0.0.2 allow remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. Vulnerabilidades múltiples CSRF en IBM WebSphere Service Registry y Repository (WSRR) 6.3.x anterior a 6.3.0.5, 7.0.x anterior a 7.0.0.5, 7.5.x anterior a 7.5.0.3, y 8.0.x anterior a 8.0.0.2 permite a usuarios remotos autenticados secuestrar la autenticación de víctimas no especificas a través de vectores no conocidos. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV26727 http://www.ibm.com/support/docview.wss?uid=swg21693379 http://www.ibm.com/support/docview.wss?uid=swg21693381 http://www.ibm.com/support/docview.wss?uid=swg21693384 http://www.ibm.com/support/docview.wss? • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 3.5EPSS: 0%CPEs: 16EXPL: 0CVE-2014-6188
https://notcve.org/view.php?id=CVE-2014-6188
Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x before 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x before 7.5.0.3, and 8.0.x before 8.0.0.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades XSS en IBM WebSphere Service Registry y Repository (WSRR) 6.3.x anterior a 6.3.0.5, 7.0.x a través de 7.0.0.5, 7.5.x anterior a 7.5.0.3, y 8.0.x anterior a 8.0.0.2 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML a través de vectores sin especificar. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV26727 http://www.ibm.com/support/docview.wss?uid=swg21693379 http://www.ibm.com/support/docview.wss?uid=swg21693381 http://www.ibm.com/support/docview.wss?uid=swg21693384 http://www.ibm.com/support/docview.wss? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 21EXPL: 0CVE-2014-6132
https://notcve.org/view.php?id=CVE-2014-6132
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad XSS en IBM WebSphere Service Registry y Repository (WSRR) 6.3 a través de 6.3.0.5, 7.0.x a través de 7.0.0.5, 7.5.x a través de 7.5.0.4, 8.0.x anterior a 8.0.0.3, y 8.5.x anterior a 8.5.0.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de vectores sin especificar. • http://secunia.com/advisories/61805 http://www-01.ibm.com/support/docview.wss?uid=swg1IV64000 http://www.ibm.com/support/docview.wss?uid=swg21693379 http://www.ibm.com/support/docview.wss?uid=swg21693381 http://www.ibm.com/support/docview.wss?uid=swg21693384 http://www.ibm.com/support/docview.wss? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •