CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2019-4268
https://notcve.org/view.php?id=CVE-2019-4268
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 160201. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0, podría permitir a un atacante remoto saltar directorios en el sistema. Un atacante podría enviar una URL especialmente diseñada que contenga secuencias (/../) "dot dot" para visualizar archivos arbitrarios sobre el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/160201 https://www.ibm.com/support/pages/node/884030 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-4285
https://notcve.org/view.php?id=CVE-2019-4285
IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could send a specially-crafted HTTP request to hijack the victim's click actions or launch other client-side browser attacks. IBM X-Force ID: 160513. WebSphere Application Server de IBM con Liberty Admin Center, podría permitir a un atacante remoto secuestrar la acción de cliqueo de la víctima. Al persuadir a una víctima para que visite un sitio web malicioso, un atacante remoto podría enviar una petición HTTP especialmente diseñada para secuestrar las acciones de cliqueo de la víctima o iniciar otros ataques del navegador del lado del cliente. • https://exchange.xforce.ibmcloud.com/vulnerabilities/160513 https://www.ibm.com/support/docview.wss?uid=ibm10884064 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-4269
https://notcve.org/view.php?id=CVE-2019-4269
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes a stack trace to be dumped. IBM X-Force ID: 160202. IBM WebSphere Application Server Admin Console versiones 7.0, 8.0, 8.5, y 9.0 podría permitirle a un atacante remoto obtener información sensible cuando una URL manipulada provoca una traza de pila para ser volcada. ID de IBM X-Force: 160202. • http://www.securityfocus.com/bid/109000 https://exchange.xforce.ibmcloud.com/vulnerabilities/160202 https://www-01.ibm.com/support/docview.wss?uid=ibm10884032 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 10.0EPSS: 19%CPEs: 3EXPL: 1CVE-2019-4279 – IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-4279
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445. IBM WebSphere Application Server 8.5 y 9.0 podría permitir a un atacante remoto ejecutar código arbitrario en el sistema con una secuencia especialmente diseñada de objetos serializados de fuentes no confiables. ID de IBM X-Force: 160445. • https://www.exploit-db.com/exploits/46969 http://www.securityfocus.com/bid/108450 https://exchange.xforce.ibmcloud.com/vulnerabilities/160445 https://www.ibm.com/support/docview.wss?uid=ibm10883628 https://www-01.ibm.com/support/docview.wss?uid=ibm10883628 • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-4080
https://notcve.org/view.php?id=CVE-2019-4080
IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5, and 9.0 is vulnerable to a potential denial of service, caused by improper parameter parsing. A remote attacker could exploit this to consume all available CPU resources. IBM X-Force ID: 157380. IBM WebSphere Application Server Admin Console 7.5, 8.0, 8.5 y 9.0 es vulnerable a una potencial denegación de servicio (DoS) provocada por un análisis incorrecta de parámetros. Un atacante remoto podría explotar esta vulnerabilidad para consumir todos los recursos de CPU disponibles. • http://www.securityfocus.com/bid/107683 https://exchange.xforce.ibmcloud.com/vulnerabilities/157380 https://www.ibm.com/support/docview.wss?uid=ibm10875692 • CWE-400: Uncontrolled Resource Consumption •