CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2021-29722
https://notcve.org/view.php?id=CVE-2021-29722
IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 201095. IBM Sterling Secure Proxy versiones 6.0.1, 6.0.2, 2.4.3.2 y 3.4.3.2, usa algoritmos criptográficos más débiles de lo esperado que podrían permitir a un atacante descifrar información altamente confidencial. IBM X-Force ID: 201095. • https://exchange.xforce.ibmcloud.com/vulnerabilities/201095 https://www.ibm.com/support/pages/node/6484681 https://www.ibm.com/support/pages/node/6484685 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2021-29736
https://notcve.org/view.php?id=CVE-2021-29736
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: 201300. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0 podría permitir a un usuario remoto alcanzar privilegios elevados en el sistema. IBM X-Force ID: 201300 • https://exchange.xforce.ibmcloud.com/vulnerabilities/201300 https://www.ibm.com/support/pages/node/6476678 •
CVSS: 5.4EPSS: 0%CPEs: 8EXPL: 2CVE-2021-20562 – IBM Sterling B2B Integrator Cross Site Scripting
https://notcve.org/view.php?id=CVE-2021-20562
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199232. IBM Sterling B2B Integrator Standard Edition versiones 5.2.0.0 hasta la versión 5.2.6.5_3 y versiones 6.1.0.0 hasta la versión 6.1.0.2 son vulnerables a las secuencias de comandos entre sitios. Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario de la web, lo que altera la funcionalidad prevista y puede conducir a la divulgación de credenciales en una sesión de confianza. • http://packetstormsecurity.com/files/164782/IBM-Sterling-B2B-Integrator-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2021/Nov/16 https://exchange.xforce.ibmcloud.com/vulnerabilities/199232 https://www.ibm.com/support/pages/node/6475301 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2021-20560
https://notcve.org/view.php?id=CVE-2021-20560
IBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and 1.5.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 199229. IBM Sterling Connect:Direct Browser User Interface versiones 1.4.1.1 y 1.5.0.2, podría permitir a un atacante remoto secuestrar la acción de hacer clic de la víctima. Al persuadir a una víctima a visitar un sitio web malicioso, un atacante remoto podría explotar esta vulnerabilidad para secuestrar las acciones de clic de la víctima y posiblemente lanzar más ataques contra la víctima. • https://exchange.xforce.ibmcloud.com/vulnerabilities/199229 https://www.ibm.com/support/pages/node/6474829 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 3.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-2381
https://notcve.org/view.php?id=CVE-2021-2381
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Solaris. • https://www.oracle.com/security-alerts/cpujul2021.html •