CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2014-6135
https://notcve.org/view.php?id=CVE-2014-6135
IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote attackers to conduct clickjacking attacks via unspecified vectors. IBM Security AppScan Enterprise 8.5 anterior a 8.5 IFix 002, 8.6 anterior a 8.6 IFix 004, 8.7 anterior a 8.7 IFix 004, 8.8 anterior a 8.8 iFix 003, 9.0 anterior a 9.0.0.1 iFix 003, y 9.0.1 anterior a 9.0.1 iFix 001 permite a atacantes remotos llevar a cabo un ataque de clickjacking a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg21693035 http://www.securitytracker.com/id/1031427 https://exchange.xforce.ibmcloud.com/vulnerabilities/96815 • CWE-20: Improper Input Validation •
CVSS: 3.5EPSS: 0%CPEs: 7EXPL: 0CVE-2014-6121
https://notcve.org/view.php?id=CVE-2014-6121
Cross-site scripting (XSS) vulnerability in IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en IBM Security AppScan Enterprise 8.5 anterior a 8.5 IFix 002, 8.6 anterior a 8.6 IFix 004, 8.7 anterior a 8.7 IFix 004, 8.8 anterior a 8.8 iFix 003, 9.0 anterior a 9.0.0.1 iFix 003, y 9.0.1 anterior a 9.0.1 iFix 001 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg21693035 http://www.securitytracker.com/id/1031427 https://exchange.xforce.ibmcloud.com/vulnerabilities/96722 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 1.8EPSS: 0%CPEs: 15EXPL: 0CVE-2014-4812
https://notcve.org/view.php?id=CVE-2014-4812
The installer in IBM Security AppScan Source 8.x and 9.x through 9.0.1 has an open network port for a debug service, which allows remote attackers to obtain sensitive information by connecting to this port. El instalador en IBM Security AppScan Source 8.x y 9.x hasta 9.0.1 tiene un puerto de red abierta para un servicio de depuración, lo que permite a atacantes remotos obtener información sensible mediante la conexión a este puerto. • http://www-01.ibm.com/support/docview.wss?uid=swg21686844 https://exchange.xforce.ibmcloud.com/vulnerabilities/95388 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2014-4806
https://notcve.org/view.php?id=CVE-2014-4806
The installation process in IBM Security AppScan Enterprise 8.x before 8.6.0.2 iFix 003, 8.7.x before 8.7.0.1 iFix 003, 8.8.x before 8.8.0.1 iFix 002, and 9.0.x before 9.0.0.1 iFix 001 on Linux places a cleartext password in a temporary file, which allows local users to obtain sensitive information by reading this file. El proceso de instalación en IBM Security AppScan Enterprise 8.x anterior a 8.6.0.2 iFix 003, 8.7.x anterior a 8.7.0.1 iFix 003, 8.8.x anterior a 8.8.0.1 iFix 002, y 9.0.x anterior a 9.0.0.1 iFix 001 en Linux coloca una contraseña en texto plano en un fichero temporal, lo que permite a usuarios locales obtener información sensible mediante la lectura de este fichero. • http://www-01.ibm.com/support/docview.wss?uid=swg21682642 http://www.securityfocus.com/bid/69435 https://exchange.xforce.ibmcloud.com/vulnerabilities/95354 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.2EPSS: 0%CPEs: 13EXPL: 0CVE-2014-3072
https://notcve.org/view.php?id=CVE-2014-3072
Unspecified vulnerability in the Automation Server in IBM Security AppScan Source 8 through 8.0.0.2, 8.5 through 8.5.0.1, 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, and 9.0 through 9.0.0.1 allows local users to gain privileges by executing a crafted service. Vulnerabilidad no especificada en Automation Server en IBM Security AppScan Source 8 hasta 8.0.0.2, 8.5 hasta 8.5.0.1, 8.6 hasta 8.6.0.2, 8.7 hasta 8.7.0.1, 8.8, y 9.0 hasta 9.0.0.1 permite a usuarios locales ganar privilegios mediante la ejecución de un servicio manipulado. • http://www-01.ibm.com/support/docview.wss?uid=swg21680537 https://exchange.xforce.ibmcloud.com/vulnerabilities/93787 •