CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1808
https://notcve.org/view.php?id=CVE-2018-1808
IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828. IBM WebSphere Commerce, desde la versión 9.0.0.0 hasta la 9.0.0.6, podría permitir la inyección de código del lado del servidor debido a un control inadecuado de las entradas. IBM X-Force ID: 149828. • http://www.securitytracker.com/id/1042034 https://exchange.xforce.ibmcloud.com/vulnerabilities/149828 https://www-01.ibm.com/support/docview.wss?uid=ibm10735905 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1798
https://notcve.org/view.php?id=CVE-2018-1798
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 149428. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • http://www.ibm.com/support/docview.wss?uid=ibm10730703 http://www.securityfocus.com/bid/105945 http://www.securitytracker.com/id/1042053 https://exchange.xforce.ibmcloud.com/vulnerabilities/149428 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1684
https://notcve.org/view.php?id=CVE-2018-1684
IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack. IBM X-Force ID: 145456. IBM WebSphere MQ desde la versión 8.0 hasta la 9.1 es vulnerable a un error en las publicaciones de cadenas de temas MQTT que puede provocar una denegación de servicio (DoS). IBM X-Force ID: 145456. • https://exchange.xforce.ibmcloud.com/vulnerabilities/145456 https://www.ibm.com/support/docview.wss?uid=ibm10734297 •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2018-1851
https://notcve.org/view.php?id=CVE-2018-1851
IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted request to the RP service, an attacker could exploit this vulnerability to execute arbitrary code. IBM X-Force ID: 150999. IBM WebSphere Application Server Liberty OpenID Connect podría permitir que un atacante remoto ejecute código arbitrario en el sistema, provocado por una deserialización incorrecta. Un atacante podría explotar esta vulnerabilidad para ejecutar código arbitrario en el sistema mediante el envío de una petición especialmente manipulada al servicio RP. • http://www.securityfocus.com/bid/105839 https://exchange.xforce.ibmcloud.com/vulnerabilities/150999 https://www.ibm.com/support/docview.wss?uid=ibm10735105 • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-1767
https://notcve.org/view.php?id=CVE-2018-1767
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148621. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 Cachemonitor es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • http://www.securitytracker.com/id/1041983 https://exchange.xforce.ibmcloud.com/vulnerabilities/148621 https://www.ibm.com/support/docview.wss?uid=ibm10729547 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •