CVSS: 10.0EPSS: 0%CPEs: 78EXPL: 0CVE-2015-1920
https://notcve.org/view.php?id=CVE-2015-1920
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session. IBM WebSphere Application Server (WAS) 6.1 hasta 6.1.0.47, 7.0 anterior a 7.0.0.39, 8.0 anterior a 8.0.0.11, y 8.5 anterior a 8.5.5.6 permite a atacantes remotos ejecutar código arbitrario mediante el envío de instrucciones manipuladas en una sesión management-port. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI38302 http://www-01.ibm.com/support/docview.wss?uid=swg21883573 http://www.securityfocus.com/bid/74439 http://www.securitytracker.com/id/1032249 • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2015-0175
https://notcve.org/view.php?id=CVE-2015-0175
IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors. IBM WebSphere Application Server (WAS) 8.5 Liberty Profile anterior a 8.5.5.5 no implementa correctamente los elementos authData, lo que permite a usuarios remotos autenticados ganar privilegios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI33008 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www.securitytracker.com/id/1032190 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.5EPSS: 0%CPEs: 8EXPL: 0CVE-2015-1882
https://notcve.org/view.php?id=CVE-2015-1882
Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user. Múltiples condiciones de carrera en IBM WebSphere Application Server (WAS) 8.5 Liberty Profile anterior a 8.5.5.5 permiten a usuarios remotos autenticados ganar privilegios mediante el aprovechamiento de conflictos de hilos que resultan en la ejecución de código Java fuera del contexto del funcionamiento como usuario EJB configurado. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI33357 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www.securityfocus.com/bid/74222 http://www.securitytracker.com/id/1032190 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.0EPSS: 0%CPEs: 8EXPL: 0CVE-2015-0174
https://notcve.org/view.php?id=CVE-2015-0174
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors. La implementación SNMP en IBM WebSphere Application Server (WAS) 8.5 anterior a 8.5.5.5 no maneja correctamente los datos de configuración, lo que permite a usuarios remotos autenticados obtener información sensible a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI21072 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www.securitytracker.com/id/1032190 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 37EXPL: 0CVE-2015-1885
https://notcve.org/view.php?id=CVE-2015-1885
WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors. WebSphereOauth20SP.ear en IBM WebSphere Application Server (WAS) 7.0 anterior a 7.0.0.39, 8.0 anterior a 8.0.0.11, 8.5 Liberty Profile anterior a 8.5.5.5, y 8.5 Full Profile anterior a 8.5.5.6, cuando el tipo de cesión OAuth requiere el envío de una contraseña, permite a atacantes remotos ganar privilegios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI33202 http://www-01.ibm.com/support/docview.wss?uid=swg1PI36211 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 http://www.securityfocus.com/bid/74219 http://www.securitytracker.com/id/1032190 • CWE-264: Permissions, Privileges, and Access Controls •