CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1840
https://notcve.org/view.php?id=CVE-2018-1840
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is configured to use a federated repository other than global federated repository and then migrated to a newer release of WebSphere Application Server. IBM X-Force ID: 150813. IBM WebSphere Application Server 8.5 y 9.0 podría permitir que un atacante remoto obtenga privilegios elevados en el sistema. Esto ocurre cuando un dominio de seguridad se configura para utilizar un repositorio federado que no sea el repositorio federado global y luego se migra a una nueva versión de WebSphere Application Server. IBM X-Force ID: 150813. • http://www.securityfocus.com/bid/106141 https://exchange.xforce.ibmcloud.com/vulnerabilities/150813 https://www.ibm.com/support/docview.wss?uid=ibm10735767 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1797
https://notcve.org/view.php?id=CVE-2018-1797
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the system. By persuading a victim to extract a specially-crafted ZIP archive containing "dot dot slash" sequences (../), an attacker could exploit this vulnerability to write to arbitrary files on the system. Note: This vulnerability is known as "Zip-Slip". IBM X-Force ID: 149427. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 empleando Enterprise bundle Archives (EBA) podría permitir que un atacante local salte directorios en el sistema. • http://www.securityfocus.com/bid/105982 http://www.securitytracker.com/id/1042146 https://exchange.xforce.ibmcloud.com/vulnerabilities/149427 https://www.ibm.com/support/docview.wss?uid=ibm10730699 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1643
https://notcve.org/view.php?id=CVE-2018-1643
The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 144588 La herramienta de verificación de instalación de IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. Esto podría dar lugar a una revelación de credenciales en una sesión de confianza. • http://www.securityfocus.com/bid/106032 http://www.securitytracker.com/id/1042088 https://exchange.xforce.ibmcloud.com/vulnerabilities/144588 https://www.ibm.com/support/docview.wss?uid=ibm10716857 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1798
https://notcve.org/view.php?id=CVE-2018-1798
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 149428. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • http://www.ibm.com/support/docview.wss?uid=ibm10730703 http://www.securityfocus.com/bid/105945 http://www.securitytracker.com/id/1042053 https://exchange.xforce.ibmcloud.com/vulnerabilities/149428 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2018-1851
https://notcve.org/view.php?id=CVE-2018-1851
IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted request to the RP service, an attacker could exploit this vulnerability to execute arbitrary code. IBM X-Force ID: 150999. IBM WebSphere Application Server Liberty OpenID Connect podría permitir que un atacante remoto ejecute código arbitrario en el sistema, provocado por una deserialización incorrecta. Un atacante podría explotar esta vulnerabilidad para ejecutar código arbitrario en el sistema mediante el envío de una petición especialmente manipulada al servicio RP. • http://www.securityfocus.com/bid/105839 https://exchange.xforce.ibmcloud.com/vulnerabilities/150999 https://www.ibm.com/support/docview.wss?uid=ibm10735105 • CWE-502: Deserialization of Untrusted Data •