CVSS: 4.0EPSS: 0%CPEs: 8EXPL: 0CVE-2015-0174
https://notcve.org/view.php?id=CVE-2015-0174
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors. La implementación SNMP en IBM WebSphere Application Server (WAS) 8.5 anterior a 8.5.5.5 no maneja correctamente los datos de configuración, lo que permite a usuarios remotos autenticados obtener información sensible a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI21072 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www.securitytracker.com/id/1032190 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 37EXPL: 0CVE-2015-1885
https://notcve.org/view.php?id=CVE-2015-1885
WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors. WebSphereOauth20SP.ear en IBM WebSphere Application Server (WAS) 7.0 anterior a 7.0.0.39, 8.0 anterior a 8.0.0.11, 8.5 Liberty Profile anterior a 8.5.5.5, y 8.5 Full Profile anterior a 8.5.5.6, cuando el tipo de cesión OAuth requiere el envío de una contraseña, permite a atacantes remotos ganar privilegios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI33202 http://www-01.ibm.com/support/docview.wss?uid=swg1PI36211 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 http://www.securityfocus.com/bid/74219 http://www.securitytracker.com/id/1032190 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 46EXPL: 0CVE-2015-0106
https://notcve.org/view.php?id=CVE-2015-0106
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en IBM Business Process Manager (BPM) 7.5.x hasta 7.5.1.2, 8.0 hasta 8.0.1.3, 8.5.0 hasta 8.5.0.1, y 8.5.5 hasta 8.5.5.0 y WebSphere Lombardi Edition (WLE) 7.2.x hasta 7.2.0.5 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1JR50795 http://www-01.ibm.com/support/docview.wss?uid=swg21694935 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 0CVE-2014-6166
https://notcve.org/view.php?id=CVE-2014-6166
The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. El servicio Communications Enabled Applications (CEA) en IBM WebSphere Application Server 8.0.x anterior a 8.0.0.10 y 8.5.x anterior a 8.5.5.4 y Feature Pack for CEA 1.x anterior a 1.0.0.15 permite a atacantes remotos a leer archivos arbitrarios mediante una declaración de identidad XML externa junto con una referencia a una entidad, relacionado con el error XML External Entity (XXE). • http://www-01.ibm.com/support/docview.wss?uid=swg1PI25310 http://www-01.ibm.com/support/docview.wss?uid=swg1PI28632 http://www-01.ibm.com/support/docview.wss?uid=swg21690185 https://exchange.xforce.ibmcloud.com/vulnerabilities/97746 •
CVSS: 5.1EPSS: 0%CPEs: 7EXPL: 0CVE-2014-8890
https://notcve.org/view.php?id=CVE-2014-8890
IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations. IBM WebSphere Application Server Liberty Profile 8.5.x anterior a 8.5.5.4 permite a atacantes remotos conseguir privilegios usando la combinación de restricciones de seguridad en los descriptores de despliegue de servlets y anotaciones ServletSecurity. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI29911 http://www-01.ibm.com/support/docview.wss?uid=swg21690185 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 http://www.securityfocus.com/bid/71834 http://www.securitytracker.com/id/1033384 https://exchange.xforce.ibmcloud.com/vulnerabilities/99009 • CWE-264: Permissions, Privileges, and Access Controls •