CVSS: 8.5EPSS: 0%CPEs: 8EXPL: 0CVE-2015-1882
https://notcve.org/view.php?id=CVE-2015-1882
Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user. Múltiples condiciones de carrera en IBM WebSphere Application Server (WAS) 8.5 Liberty Profile anterior a 8.5.5.5 permiten a usuarios remotos autenticados ganar privilegios mediante el aprovechamiento de conflictos de hilos que resultan en la ejecución de código Java fuera del contexto del funcionamiento como usuario EJB configurado. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI33357 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www.securityfocus.com/bid/74222 http://www.securitytracker.com/id/1032190 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.0EPSS: 0%CPEs: 8EXPL: 0CVE-2015-0174
https://notcve.org/view.php?id=CVE-2015-0174
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors. La implementación SNMP en IBM WebSphere Application Server (WAS) 8.5 anterior a 8.5.5.5 no maneja correctamente los datos de configuración, lo que permite a usuarios remotos autenticados obtener información sensible a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI21072 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www.securitytracker.com/id/1032190 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 37EXPL: 0CVE-2015-1885
https://notcve.org/view.php?id=CVE-2015-1885
WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors. WebSphereOauth20SP.ear en IBM WebSphere Application Server (WAS) 7.0 anterior a 7.0.0.39, 8.0 anterior a 8.0.0.11, 8.5 Liberty Profile anterior a 8.5.5.5, y 8.5 Full Profile anterior a 8.5.5.6, cuando el tipo de cesión OAuth requiere el envío de una contraseña, permite a atacantes remotos ganar privilegios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI33202 http://www-01.ibm.com/support/docview.wss?uid=swg1PI36211 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 http://www.securityfocus.com/bid/74219 http://www.securitytracker.com/id/1032190 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 46EXPL: 0CVE-2015-0106
https://notcve.org/view.php?id=CVE-2015-0106
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0 hasta 8.0.1.3, 8.5.0 hasta 8.5.0.1, y 8.5.5 hasta 8.5.5.0 y WebSphere Lombardi Edition (WLE) 7.2.x hasta 7.2.0.5 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR50795 http://www-01.ibm.com/support/docview.wss?uid=swg21694935 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 0CVE-2014-6166
https://notcve.org/view.php?id=CVE-2014-6166
The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. El servicio Communications Enabled Applications (CEA) en IBM WebSphere Application Server 8.0.x anterior a 8.0.0.10 y 8.5.x anterior a 8.5.5.4 y Feature Pack for CEA 1.x anterior a 1.0.0.15 permite a atacantes remotos a leer archivos arbitrarios mediante una declaración de identidad XML externa junto con una referencia a una entidad, relacionado con el error XML External Entity (XXE). • http://www-01.ibm.com/support/docview.wss?uid=swg1PI25310 http://www-01.ibm.com/support/docview.wss?uid=swg1PI28632 http://www-01.ibm.com/support/docview.wss?uid=swg21690185 https://exchange.xforce.ibmcloud.com/vulnerabilities/97746 •