CVSS: 4.3EPSS: 0%CPEs: 34EXPL: 0CVE-2013-0549
https://notcve.org/view.php?id=CVE-2013-0549
Cross-site scripting (XSS) vulnerability in the Web Content Manager - Web Content Viewer Portlet in the server in IBM WebSphere Portal 7.0.0.x through 7.0.0.2 CF22 and 8.0.0.x through 8.0.0.1 CF5, when the IBM Portlet API is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad Cross-site scripting (XSS) en Web Content Manager - Web Content Viewer Portlet en el servidor IBM WebSphere Portal v7.0.0.x hasta v7.0.0.2 CF22 y v8.0.0.x hasta v8.0.0.1 CF5, cuando se utiliza la API IBM Portlet, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1PM84525 http://www-01.ibm.com/support/docview.wss?uid=swg21638984 https://exchange.xforce.ibmcloud.com/vulnerabilities/82762 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 44EXPL: 0CVE-2013-0482
https://notcve.org/view.php?id=CVE-2013-0482
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a crafted SOAP message, related to a "Signature Wrap attack," a different vulnerability than CVE-2011-1377 and CVE-2013-0489. IBM WebSphere Application Server (WAS) 7.0 anterior a 7.0.0.29, 8.0 anterior a 8.0.0.6, y 8.5 a la 8.5.0.2 y WebSphere Message Broker 6.1, 7.0 a la 7.0.0.5, y 8.0 a la 8.0.0.2, cuando se usa WS-Security, permite a atacantes remotos suplantar las firmas de los mensajes a través de mensajes SOAP manipulados relacionado con "Signature Wrap attack," vulnerabilidad distinta de CVE-2011-1377 y CVE-2013-0489. • http://www-01.ibm.com/support/docview.wss?uid=swg1IC88185 http://www-01.ibm.com/support/docview.wss?uid=swg1PM76582 http://www-01.ibm.com/support/docview.wss?uid=swg1PM86026 http://www-01.ibm.com/support/docview.wss?uid=swg21634646 http://www-01.ibm.com/support/docview.wss? •
CVSS: 4.3EPSS: 0%CPEs: 42EXPL: 2CVE-2013-0499
https://notcve.org/view.php?id=CVE-2013-0499
Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services. Una vulnerabilidad de tipo cross-site scripting (XSS) en la funcionalidad echo en dispositivos SOA WebSphere DataPower de IBM con la versión de firmware 3.8.2, 4.0, 4.0.1, 4.0.2 y 5.0.0, permite a los atacantes remotos inyectar script web o HTML arbitrarios por medio de un mensaje SOAP, como es demostrado por los servicios Firewall XML, Multi Protocol Gateway (MPGW), Proxy de servicio web y Token web. • http://seclists.org/bugtraq/2013/May/83 http://www-01.ibm.com/support/docview.wss?uid=swg21637717 https://exchange.xforce.ibmcloud.com/vulnerabilities/82221 https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 0CVE-2013-0600
https://notcve.org/view.php?id=CVE-2013-0600
Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote attackers to bypass authentication and perform administrative actions via unknown vectors. Vulnerabilidad sin especificar en dispositivos IBM WebSphere DataPower XC10 Appliance v2.0 y v2.1 hasta v2.1 FP3 lo que permite a atacantes remotos burlar la autenticación y realizar acciones administraticas a través de vectores sin especificar. • http://www-01.ibm.com/support/docview.wss?uid=swg1IC91726 http://www-01.ibm.com/support/docview.wss?uid=swg21636324 •
CVSS: 4.0EPSS: 0%CPEs: 57EXPL: 0CVE-2013-0544
https://notcve.org/view.php?id=CVE-2013-0544
Directory traversal vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux and UNIX allows remote authenticated users to modify data via unspecified vectors. Vulnerabilidad de salto de directorio en la consola administrativa de IBM WebSphere Application Server (WAS) v6.1 antes v6.1.0.47, v7.0 antes de v7.0.0.29, v8,0 antes v8.0.0.6 y v8.5 antes de v8.5.0.2 en Linux y UNIX permite a usuarios remotos autenticados modificar datos a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?&uid=swg21632423 http://www-01.ibm.com/support/docview.wss?uid=swg1PM82468 https://exchange.xforce.ibmcloud.com/vulnerabilities/82760 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •