CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2020-4575
https://notcve.org/view.php?id=CVE-2020-4575
IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability Deployment Manager is configured. IBM WebSphere Application Server ND versiones 8.5 y 9.0, e IBM WebSphere Virtual Enterprise versiones 7.0 y 8.0, son vulnerables a un ataque de tipo cross-site scripting cuando High Availability Deployment Manager es configurado • https://exchange.xforce.ibmcloud.com/vulnerabilities/184363 https://www.ibm.com/support/pages/node/6323293 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 3%CPEs: 4EXPL: 0CVE-2020-4448 – IBM WebSphere UploadFileArgument Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-4448
IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 181228. IBM WebSphere Application Server Network Deployment versiones 7.0, 8.0, 8.5 y 9.0, podría permitir a un atacante remoto ejecutar código arbitrario en el sistema con una secuencia de objetos serializados especialmente diseñada de fuentes no confiables. ID de IBM X-Force: 181228 This vulnerability allows remote attackers to execute arbitrary code on affected installations of IBM WebSphere. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BroadcastMessageManager class. • https://exchange.xforce.ibmcloud.com/vulnerabilities/181228 https://www.ibm.com/support/pages/node/6220336 https://www.zerodayinitiative.com/advisories/ZDI-20-688 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2019-4505
https://notcve.org/view.php?id=CVE-2019-4505
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caused by sending a specially-crafted URL. This can lead the attacker to view any file in a certain directory. IBM X-Force ID: 164364. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0, Network Deployment podría permitir a un atacante remoto obtener información confidencial, causado mediante el envío de una URL especialmente diseñada. Esto puede conllevar al atacante a visualizar cualquier archivo en un directorio determinado. • https://exchange.xforce.ibmcloud.com/vulnerabilities/164364 https://www.ibm.com/support/pages/node/964766 •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2019-4030
https://notcve.org/view.php?id=CVE-2019-4030
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155946. IBM WebSphere Application Server, en sus versiones 8.5 y 9.0, es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • http://www.ibm.com/support/docview.wss?uid=ibm10869406 https://exchange.xforce.ibmcloud.com/vulnerabilities/155946 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 55EXPL: 0CVE-2015-1932
https://notcve.org/view.php?id=CVE-2015-1932
IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header. Vulnerabilidad en IBM WebSpher Application Server en 7.x en versiones anteriores a 7.0.0.39, 8.0.x en versiones anteriores a 8.0.0.11, 8.5.x en versiones anteriores a 8.5.5.7 y WebSphere Virtual Enterprise en versiones anteriores a 7.0.0.7, permite a atacantes remotos obtener información potencialmente sensible sobre el software del servidor proxy leyendo el HTTP a través de las cabeceras. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI38403 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 http://www.securityfocus.com/bid/76466 http://www.securitytracker.com/id/1033325 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •