CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1794
https://notcve.org/view.php?id=CVE-2018-1794
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148949. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0, utilizando OAuth, es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • http://www.securitytracker.com/id/1041802 https://exchange.xforce.ibmcloud.com/vulnerabilities/148949 https://www.ibm.com/support/docview.wss?uid=ibm10729571 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1683
https://notcve.org/view.php?id=CVE-2018-1683
IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB communication. IBM X-Force ID: 145455. IBM WebSphere Application Server Liberty podría permitir que un atacante remoto obtenga información sensible, provocado por la imposibilidad de cifrar las comunicaciones ORB. IBM X-Force ID: 145455. • http://www.securitytracker.com/id/1041720 https://exchange.xforce.ibmcloud.com/vulnerabilities/145455 https://www.ibm.com/support/docview.wss?uid=ibm10716533 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1567
https://notcve.org/view.php?id=CVE-2018-1567
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connector with a serialized object from untrusted sources. IBM X-Force ID: 143024. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 podría permitir que atacantes remotos ejecuten código Java arbitrario mediante el conector SOAP con un objeto serializado desde fuentes no fiables. IBM X-Force ID: 143024. • http://www.securitytracker.com/id/1041644 https://exchange.xforce.ibmcloud.com/vulnerabilities/143024 https://www.ibm.com/support/docview.wss?uid=swg22016254 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1695
https://notcve.org/view.php?id=CVE-2018-1695
IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a remote attacker to conduct spoofing attacks. IBM X-Force ID: 145769. Las instalaciones de IBM WebSphere Application Server 7.0, 8.0 y 8.5.5 que emplean Form Login podrían permitir que un atacante remoto lleve a cabo ataques de suplantación. IBM X-Force ID: 145769. • http://www.securitytracker.com/id/1041643 https://exchange.xforce.ibmcloud.com/vulnerabilities/145769 https://www-01.ibm.com/support/docview.wss?uid=ibm10716523 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 6.7EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1621
https://notcve.org/view.php?id=CVE-2018-1621
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 podría permitir que un atacante local obtenga contraseñas en texto claro en un archivo trace provocado por la gestión incorrecta de algunas propiedades datasource personalizadas. IBM X-Force ID: 144346. • http://www.ibm.com/support/docview.wss?uid=swg22016821 http://www.securitytracker.com/id/1041226 https://exchange.xforce.ibmcloud.com/vulnerabilities/144346 • CWE-312: Cleartext Storage of Sensitive Information •