CVSS: 9.1EPSS: 0%CPEs: 8EXPL: 0CVE-2022-22489
https://notcve.org/view.php?id=CVE-2022-22489
IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339. IBM MQ versiones 8.0, (9.0, 9.1, 9.2 LTS) y (9.1 y 9.2 CD) son vulnerables a un ataque de tipo XML External Entity Injection (XXE) cuando son procesados datos XML. Un atacante remoto podría aprovechar esta vulnerabilidad para exponer información confidencial o consumir recursos de memoria. • https://exchange.xforce.ibmcloud.com/vulnerabilities/226339 https://www.ibm.com/support/pages/node/6613021 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-38875
https://notcve.org/view.php?id=CVE-2021-38875
IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD is vulnerable to a denial of service attack caused by an error processing messages. IBM X-Force ID: 208398. IBM MQ versiones 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD y 9.2 CD, es vulnerable a un ataque de denegación de servicio causado por un error de procesamiento de mensajes. IBM X-Force ID: 208398 • https://exchange.xforce.ibmcloud.com/vulnerabilities/208398 https://www.ibm.com/support/pages/node/6517672 •
CVSS: 6.2EPSS: 0%CPEs: 11EXPL: 0CVE-2021-38949
https://notcve.org/view.php?id=CVE-2021-38949
IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403. IBM MQ versiones 7.5, 8.0, 9.0 LTS, 9.1 CD y 9.1 LTS, almacena las credenciales de usuario en texto sin cifrar que puede ser leído por un usuario local. IBM X-Force ID: 211403 • https://exchange.xforce.ibmcloud.com/vulnerabilities/211403 https://www.ibm.com/support/pages/node/6516424 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 10.0EPSS: 1%CPEs: 47EXPL: 0CVE-2020-4682
https://notcve.org/view.php?id=CVE-2020-4682
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509. IBM MQ versiones 7.5, 8.0, 9.0, 9.1, 9.2 LTS y 9.2 CD, podrían permitir a un atacante remoto ejecutar código arbitrario en el sistema, causado por una deserialización no segura de datos confiables. Un atacante podría explotar esta vulnerabilidad para ejecutar código arbitrario en el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/186509 https://www.ibm.com/support/pages/node/6408626 • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2020-4320
https://notcve.org/view.php?id=CVE-2020-4320
IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting. IBM X-Force ID: 177403. IBM MQ Appliance e IBM MQ AMQP Channels versiones 8.0, 9.0 LTS, 9.1 LTS y 9.1 CD, no bloquean ni habilitan correctamente a los clientes basados en la configuración SSLPEER del nombre distinguido del certificado. IBM X-Force ID: 177403 • https://exchange.xforce.ibmcloud.com/vulnerabilities/177403 https://www.ibm.com/support/pages/node/5736885 • CWE-295: Improper Certificate Validation •