CVSS: 4.0EPSS: 0%CPEs: 8EXPL: 0CVE-2015-0174
https://notcve.org/view.php?id=CVE-2015-0174
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors. La implementación SNMP en IBM WebSphere Application Server (WAS) 8.5 anterior a 8.5.5.5 no maneja correctamente los datos de configuración, lo que permite a usuarios remotos autenticados obtener información sensible a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI21072 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www.securitytracker.com/id/1032190 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 0CVE-2014-6166
https://notcve.org/view.php?id=CVE-2014-6166
The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. El servicio Communications Enabled Applications (CEA) en IBM WebSphere Application Server 8.0.x anterior a 8.0.0.10 y 8.5.x anterior a 8.5.5.4 y Feature Pack for CEA 1.x anterior a 1.0.0.15 permite a atacantes remotos a leer archivos arbitrarios mediante una declaración de identidad XML externa junto con una referencia a una entidad, relacionado con el error XML External Entity (XXE). • http://www-01.ibm.com/support/docview.wss?uid=swg1PI25310 http://www-01.ibm.com/support/docview.wss?uid=swg1PI28632 http://www-01.ibm.com/support/docview.wss?uid=swg21690185 https://exchange.xforce.ibmcloud.com/vulnerabilities/97746 •
CVSS: 4.3EPSS: 0%CPEs: 48EXPL: 0CVE-2014-6174
https://notcve.org/view.php?id=CVE-2014-6174
IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to conduct clickjacking attacks via a crafted web site. IBM WebSphere Application Server 7.x anterior a 7.0.0.37, 8.0.x anterior a 8.0.0.10 y 8.5.x anterior a 8.5.5.4 permiten a atacantes remotos llevar a cabo un ataque de clickjacking a través de un sitio web manipulado. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI27152 http://www-01.ibm.com/support/docview.wss?uid=swg21690185 https://exchange.xforce.ibmcloud.com/vulnerabilities/98486 • CWE-254: 7PK - Security Features •
CVSS: 5.0EPSS: 0%CPEs: 17EXPL: 0CVE-2014-6164
https://notcve.org/view.php?id=CVE-2014-6164
IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4 allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain sensitive information, via a crafted URL. IBM WebSphere Application Server 8.0.x anterior a 8.0.0.10 y 8.5.x anterior a 8.5.5.4 permite a atacantes remotos falsificar las cookies de OpenID y OpenID connect y en consecuencia, obtener información sensible mediante URL modificadas. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI23430 http://www-01.ibm.com/support/docview.wss?uid=swg21690185 https://exchange.xforce.ibmcloud.com/vulnerabilities/97713 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 48EXPL: 0CVE-2014-6167
https://notcve.org/view.php?id=CVE-2014-6167
Cross-site scripting (XSS) vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en la funcionalidad de reescritura de URL en IBM WebSphere Application Server 7.x anterior a 7.0.0.37, 8.0.x anterior a 8.0.0.10 y 8.5.x anterior a 8.5.5.4 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI23819 http://www-01.ibm.com/support/docview.wss?uid=swg21690185 https://exchange.xforce.ibmcloud.com/vulnerabilities/97748 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •