CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37400 – IBM Aspera Faspex privilege escalation
https://notcve.org/view.php?id=CVE-2023-37400
IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to escalate their privileges due to insecure credential storage. IBM X-Force ID: 259677. IBM Aspera Faspex 5.0.0 a 5.0.7 podría permitir a un usuario local escalar sus privilegios debido a un almacenamiento de credenciales inseguro. ID de IBM X-Force: 259677. • https://exchange.xforce.ibmcloud.com/vulnerabilities/259677 https://www.ibm.com/support/pages/node/7148631 • CWE-522: Insufficiently Protected Credentials •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22329 – IBM WebSphere Application Server server-side request forgery
https://notcve.org/view.php?id=CVE-2024-22329
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker could exploit this vulnerability to conduct the SSRF attack. X-Force ID: 279951. IBM WebSphere Application Server 8.5, 9.0 e IBM WebSphere Application Server Liberty 17.0.0.3 a 24.0.0.3 son vulnerables a server-side request forgery (SSRF). Al enviar una solicitud especialmente manipulada, un atacante podría aprovechar esta vulnerabilidad para realizar el ataque SSRF. • https://exchange.xforce.ibmcloud.com/vulnerabilities/279951 https://www.ibm.com/support/pages/node/7148380 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22354 – IBM WebSphere Application Server XML external entity injection
https://notcve.org/view.php?id=CVE-2024-22354
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, or to conduct a server-side request forgery attack. IBM X-Force ID: 280401. IBM WebSphere Application Server 8.5, 9.0 e IBM WebSphere Application Server Liberty 17.0.0.3 a 24.0.0.3 son vulnerables a un ataque de inyección de entidad externa XML (XXE) al procesar datos XML. Un atacante remoto podría aprovechar esta vulnerabilidad para exponer información confidencial, consumir recursos de memoria o realizar un ataque de server-side request forgery. • https://exchange.xforce.ibmcloud.com/vulnerabilities/280401 https://www.ibm.com/support/pages/node/7148426 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31887 – IBM Security Verify Privilege information disclosure
https://notcve.org/view.php?id=CVE-2024-31887
IBM Security Verify Privilege 11.6.25 could allow an unauthenticated actor to obtain sensitive information from the SOAP API. IBM X-Force ID: 287651. IBM Security Verify Privilege 11.6.25 podría permitir que un actor no autenticado obtenga información confidencial de la API SOAP. ID de IBM X-Force: 287651. • https://exchange.xforce.ibmcloud.com/vulnerabilities/287651 https://www.ibm.com/support/pages/node/7148438 • CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere •
CVSS: 6.3EPSS: 0%CPEs: 5EXPL: 0CVE-2024-22358 – IBM UrbanCode Deploy session fixation
https://notcve.org/view.php?id=CVE-2024-22358
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 280896. IBM UrbanCode Deploy (UCD) 7.0 a 7.0.5.20, 7.1 a 7.1.2.16, 7.2 a 7.2.3.9, 7.3 a 7.3.2.4 e IBM DevOps Deploy 8.0 a 8.0.0.1 no invalida la sesión después del cierre de sesión, lo que podría permitir un usuario autenticado para hacerse pasar por otro usuario en el sistema. ID de IBM X-Force: 280896. • https://exchange.xforce.ibmcloud.com/vulnerabilities/280896 https://www.ibm.com/support/pages/node/7148109 • CWE-613: Insufficient Session Expiration •