CVSS: 4.9EPSS: 32%CPEs: 10EXPL: 2CVE-2016-9722 – IBM QRadar SIEM - Remote Code Execution
https://notcve.org/view.php?id=CVE-2016-9722
10 Jan 2018 — IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 119737. IBM QRadar 7.2 y 7.3 especifica permisos para un recurso crítico para la seguridad de forma que permite que ese recurso sea leído o modificado por actores no planeados. IBM X-Force ID: 119737. • https://packetstorm.news/files/id/148488 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2017-1162
https://notcve.org/view.php?id=CVE-2017-1162
12 Sep 2017 — IBM QRadar 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 122957. IBM QRadar 7.2 y 7.3 divulga información sensible a usuarios sin autorización. Esta información puede emplearse para ejecutar más ataques en el sistema. • http://www.ibm.com/support/docview.wss?uid=swg22008194 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 17EXPL: 0CVE-2016-9972
https://notcve.org/view.php?id=CVE-2016-9972
27 Jun 2017 — IBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 120208. IBM QRadar 7.2 y 7.3 podría permitir que un atacante remoto obtenga información sensible, provocado por la imposibilidad de habilitar correctamente HTTP Strict Transport Security. Un atacante podría explotar esta vul... • http://www.ibm.com/support/docview.wss?uid=swg22004925 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 0CVE-2016-9738
https://notcve.org/view.php?id=CVE-2016-9738
27 Jun 2017 — IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 119783. IBM QRadar 7.2 y 7.3 no requiere que los usuarios tengan contraseñas fuertes por defecto, lo que facilita que los atacantes comprometan las cuentas de usuario. IBM X-Force ID: 119783. • http://www.ibm.com/support/docview.wss?uid=swg22004926 • CWE-254: 7PK - Security Features •
CVSS: 5.4EPSS: 0%CPEs: 17EXPL: 0CVE-2017-1234
https://notcve.org/view.php?id=CVE-2017-1234
27 Jun 2017 — IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123913. IBM Qradar 7.2 y 7.3 es vulnerable a cross-site scripting. Esta vulnerabilidad permite a los usuarios incrustar código Javascript aleatorio en la interfaz Web lo que alteraría la funcionalidad planeada potencialmente llevando a la r... • http://www.ibm.com/support/docview.wss?uid=swg22004948 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9750
https://notcve.org/view.php?id=CVE-2016-9750
15 May 2017 — IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 120207. IBM QRadar 7.2 y 7.3 almacena las credenciales de usuario en texto claro que puede ser leído por un usuario autenticado. IBM X-Force ID: 120207. • http://www.ibm.com/support/docview.wss?uid=swg22003137 • CWE-255: Credentials Management Errors •
CVSS: 10.0EPSS: 88%CPEs: 345EXPL: 23CVE-2014-7169 – GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-7169
25 Sep 2014 — GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a ... • https://packetstorm.news/files/id/128650 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-228: Improper Handling of Syntactically Invalid Structure •
CVSS: 10.0EPSS: 94%CPEs: 345EXPL: 137CVE-2014-6271 – GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-6271
24 Sep 2014 — GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." N... • https://packetstorm.news/files/id/181111 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •