CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-4720
https://notcve.org/view.php?id=CVE-2019-4720
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume all available memory. IBM X-Force ID: 172125. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0, es vulnerable a una denegación de servicio, causada mediante el envío de una petición especialmente diseñada. Un atacante remoto podría explotar esta vulnerabilidad para causar que el servidor consuma toda la memoria disponible. • https://exchange.xforce.ibmcloud.com/vulnerabilities/172125 https://www.ibm.com/support/pages/node/1285372 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-4663
https://notcve.org/view.php?id=CVE-2019-4663
IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171245. IBM WebSphere Application Server - Liberty es vulnerable a ataques de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar código JavaScript arbitrario en la Interfaz de Usuario Web, alterando así la funcionalidad prevista conllevando a una divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/171245 https://www.ibm.com/support/pages/node/1127367 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 9EXPL: 0CVE-2019-4441
https://notcve.org/view.php?id=CVE-2019-4441
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 163177. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5, 9.0 y Liberty, podrían permitir a un atacante remoto obtener información confidencial cuando un rastro de pila es devuelta en el navegador. ID de IBM X-Force: 163177. • https://exchange.xforce.ibmcloud.com/vulnerabilities/163177 https://www.ibm.com/support/pages/node/959023 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-4305
https://notcve.org/view.php?id=CVE-2019-4305
IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951. IBM WebSphere Application Server Liberty, podría permitir a un atacante remoto obtener información confidencial causada por la configuración inapropiada de una cookie. ID de IBM X-Force: 160951. • https://exchange.xforce.ibmcloud.com/vulnerabilities/160951 https://www.ibm.com/support/pages/node/960171 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-4304
https://notcve.org/view.php?id=CVE-2019-4304
IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM X-Force ID: 160950. IBM WebSphere Application Server - Liberty, podría permitir a un atacante remoto omitir las restricciones de seguridad causadas por una comprobación de sesión inapropiada. ID de IBM X-Force: 160950. • https://exchange.xforce.ibmcloud.com/vulnerabilities/160950 https://www.ibm.com/support/pages/node/960171 • CWE-384: Session Fixation •