CVSS: 3.5EPSS: 0%CPEs: 20EXPL: 0CVE-2014-8897
https://notcve.org/view.php?id=CVE-2014-8897
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8898 and CVE-2014-8899. Vulnerabilidad de XSS en el Collaboration Server en IBM InfoSphere Master Data Management Server para Product Information Management 9.x hasta la versión 9.1 e InfoSphere Master Data Management - Collaborative Edition 10.x hasta la versión 10.1, 11.0 en versiones anteriores a FP7 y 11.3 y 11.4 en versiones anteriores a 11.4 FP1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada, una vulnerabilidad diferente a CVE-2014-8898 y CVE-2014-8899. • http://www-01.ibm.com/support/docview.wss?uid=swg21692176 https://exchange.xforce.ibmcloud.com/vulnerabilities/99050 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 20EXPL: 0CVE-2014-8896
https://notcve.org/view.php?id=CVE-2014-8896
The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to modify the administrator's credentials and consequently gain privileges via unspecified vectors. El servidor Collaboration Server en IBM InfoSphere Master Data Management Server for Product Information Management 9.x hasta 9.1 e InfoSphere Master Data Management - Collaborative Edition 10.x hasta 10.1, 11.0 anterior a FP7, 11.3 y 11.4 anterior a 11.4 FP1 permiten a usuarios remotos autenticados modificar las credenciales del administrador y consecuentemente obtener privilegios a través de vectores sin especificar. • http://www-01.ibm.com/support/docview.wss?uid=swg21692176 https://exchange.xforce.ibmcloud.com/vulnerabilities/99049 • CWE-287: Improper Authentication •
CVSS: 3.5EPSS: 0%CPEs: 20EXPL: 0CVE-2014-8898
https://notcve.org/view.php?id=CVE-2014-8898
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8897 and CVE-2014-8899. Vulnerabilidad de XSS en el Collaboration Server en IBM InfoSphere Master Data Management Server para Product Information Management 9.x hasta la versión 9.1 e InfoSphere Master Data Management - Collaborative Edition 10.x hasta la versión 10.1, 11.0 en versiones anteriores a FP7 y 11.3 y 11.4 en versiones anteriores a 11.4 FP1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada, una vulnerabilidad diferente a CVE-2014-8897 y CVE-2014-8899. • http://www-01.ibm.com/support/docview.wss?uid=swg21692176 https://exchange.xforce.ibmcloud.com/vulnerabilities/99051 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 20EXPL: 0CVE-2014-8899
https://notcve.org/view.php?id=CVE-2014-8899
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8897 and CVE-2014-8898. Vulnerabilidad de XSS en el Collaboration Server en IBM InfoSphere Master Data Management Server para Product Information Management 9.x hasta la versión 9.1 e InfoSphere Master Data Management - Collaborative Edition 10.x hasta la versión 10.1, 11.0 en versiones anteriores a FP7 y 11.3 y 11.4 en versiones anteriores a 11.4 FP1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada, una vulnerabilidad diferente a CVE-2014-8897 y CVE-2014-8898. • http://www-01.ibm.com/support/docview.wss?uid=swg21692176 https://exchange.xforce.ibmcloud.com/vulnerabilities/99052 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 89%CPEs: 345EXPL: 17CVE-2014-7169 – GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-7169
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271. GNU Bash hasta 4.3 bash43-025 procesa cadenas finales después de la definición malformada de funciones en los valores de variables de entorno, lo que permite a atacantes remotos escribir hacia ficheros o posiblemente tener otro impacto desconocido a través de un entorno manipulado, tal y como se ha demostrado por vectores que involucran la característica ForceCommand en sshd OpenSSH, los módulos mod_cgi y mod_cgid en el Apache HTTP Server, scripts ejecutados por clientes DHCP no especificados, y otras situaciones en la cual establecer el entorno ocurre a través de un límite privilegiado de la ejecución de Bash. Nota: Esta vulnerabilidad existe debido a una solución incompleta para CVE-2014-6271. It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. • https://www.exploit-db.com/exploits/34777 https://www.exploit-db.com/exploits/34895 https://www.exploit-db.com/exploits/34839 https://www.exploit-db.com/exploits/36503 https://www.exploit-db.com/exploits/36504 https://www.exploit-db.com/exploits/34766 https://www.exploit-db.com/exploits/35115 https://www.exploit-db.com/exploits/36933 https://www.exploit-db.com/exploits/34765 https://www.exploit-db.com/exploits/34860 https://www.exploit-db.com/exploits/34879 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-228: Improper Handling of Syntactically Invalid Structure •