CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-4046
https://notcve.org/view.php?id=CVE-2019-4046
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker could exploit this vulnerability to cause the consumption of Memory. IBM X-Force ID: 156242. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 es vulnerable a denegaciones de servicio causadas por una gestión inadecuada de las cabeceras de peticiones. Un atacante remoto podría explotar esta vulnerabilidad para provocar un consumo de memoria. • http://www.securityfocus.com/bid/107623 https://exchange.xforce.ibmcloud.com/vulnerabilities/156242 https://www.ibm.com/support/docview.wss?uid=ibm10869570 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-1902
https://notcve.org/view.php?id=CVE-2018-1902
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. IBM X-Force ID: 152531. IBM WebSphere Application Server, en versiones 7.0, 8.0, 8.5 y 9.0, podría permitir a un atacante remoto suplantar la información de conexión, la cual podría emplearse para lanzar otros ataques contra el sistema. IBM X-Force ID: 152531. • http://www.securityfocus.com/bid/107383 https://exchange.xforce.ibmcloud.com/vulnerabilities/152531 https://www.ibm.com/support/docview.wss?uid=ibm10795115 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1996
https://notcve.org/view.php?id=CVE-2018-1996
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration. A remote attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 154650. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 podría proporcionar seguridad más débil de la esperada debido a una configuración TLS incorrecta. Un atacante remoto podría explotar esta vulnerabilidad para obtener información sensible empleando técnicas Man-in-the-Middle (MitM). • http://www.securityfocus.com/bid/107155 https://exchange.xforce.ibmcloud.com/vulnerabilities/154650 https://www.ibm.com/support/docview.wss?uid=ibm10793421 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1926
https://notcve.org/view.php?id=CVE-2018-1926
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could exploit this vulnerability to perform CSRF attack and update available applications. IBM X-Force ID: 152992. La consola de administrador de IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 es vulnerable a ataques Cross-Site Request Forgery (CSRF) a causa de una validación incorrecta de entradas proporcionadas por el usuario. • http://www.securityfocus.com/bid/106204 https://exchange.xforce.ibmcloud.com/vulnerabilities/152992 https://www.ibm.com/support/docview.wss?uid=ibm10742301 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1904
https://notcve.org/view.php?id=CVE-2018-1904
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. IBM X-Force ID: 152533. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 podría permitir que atacantes remotos ejecuten código Java arbitrario mediante una clase del cliente administrativo con un objeto serializado desde fuentes no fiables. IBM X-Force ID: 152533. • http://www.securityfocus.com/bid/106193 https://exchange.xforce.ibmcloud.com/vulnerabilities/152533 https://www-01.ibm.com/support/docview.wss?uid=ibm10738735 • CWE-502: Deserialization of Untrusted Data •