CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2013-3983
https://notcve.org/view.php?id=CVE-2013-3983
The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not validate URLs in Cookie headers before using them in redirects, which has unspecified impact and remote attack vectors. Meeting Server en IBM Sametime 8.5.2 hasta 8.5.2.1 y 9.x hasta 9.0.0.1 no valida URLs en cebeceras de Cookies antes de su utilización en redirecciones, lo que tiene un impacto no especificado y vectores de ataques remotos. • http://www-01.ibm.com/support/docview.wss?uid=swg21662928 https://exchange.xforce.ibmcloud.com/vulnerabilities/84966 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2013-3978
https://notcve.org/view.php?id=CVE-2013-3978
The Meeting Server in IBM Sametime 8.5.2 through 8.5.2.1 and 9.x through 9.0.0.1 does not send the appropriate HTTP response headers to prevent unwanted caching by a web browser, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation. Meeting Server en IBM Sametime 8.5.2 hasta 8.5.2.1 y 9.x hasta 9.0.0.1 no envía las debidas cabeceras de respuesta HTTP para prevenir el cacheo no deseado por un navegador, lo que permite a atacantes remotos obtener información sensible mediante el aprovechamiento de una estación de trabajo no atendida. • http://www-01.ibm.com/support/docview.wss?uid=swg21662928 https://exchange.xforce.ibmcloud.com/vulnerabilities/84902 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2013-6727
https://notcve.org/view.php?id=CVE-2013-6727
The Connect client in IBM Sametime 8.5.2 through 8.5.2.1 and 9.0 before HF1 does not properly restrict unsigned Java plugins, which allows remote attackers to obtain sensitive information via unspecified vectors. El cliente Connect en IBM Sametime 8.5.2 hasta la versión 8.5.2.1 y 9.0 anterior a HF1 no restringe adecuadamente los plugins de Java sin firmar, lo que permite a atacantes remotos obtener información sensible a través de vectores sin especificar. • http://www-01.ibm.com/support/docview.wss?uid=swg21662725 https://exchange.xforce.ibmcloud.com/vulnerabilities/89282 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 0CVE-2013-6733
https://notcve.org/view.php?id=CVE-2013-6733
Cross-site scripting (XSS) vulnerability in the Web Application in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de cross-site scripting (XSS) en la Web Application en el Classic Meeting Server de IBM Sametime Classic en 7.5.1.2 hasta la 8.5.2.1 que permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg21659419 https://exchange.xforce.ibmcloud.com/vulnerabilities/89396 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 1.9EPSS: 0%CPEs: 10EXPL: 0CVE-2013-0534
https://notcve.org/view.php?id=CVE-2013-0534
The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, and 8.5.2.1, as used in the Lotus Notes client and separately, might allow local users to obtain sensitive information by leveraging the persistence of cleartext password strings within process memory. El cliente Connect en IBM Sametime v8.5.1, v8.5.1.1, v8.5.1.2, v8.5.2, y v8.5.2.1, como se usaba en el cliente Lotus Notes puede permitir a usuarios locales obtener información sensible mediante el aprovechamiento de contraseñas persistentes en texto plano dentro de la memoria del proceso. • http://www-01.ibm.com/support/docview.wss?uid=swg21635218 https://exchange.xforce.ibmcloud.com/vulnerabilities/82656 • CWE-255: Credentials Management Errors •