CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-3897
https://notcve.org/view.php?id=CVE-2021-3897
22 Apr 2022 — An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware during an that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected. Se ha detectado una vulnerabilidad de omisión de autenticación en un servicio interno del firmware de Lenovo Fan Power Controller2 (FPC2) y Lenovo System Management Module (SMM) durante un que podría permitir a un atacante ... • https://support.lenovo.com/us/en/product_security/LEN-72615 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 9.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-3849
https://notcve.org/view.php?id=CVE-2021-3849
22 Apr 2022 — An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected. Se ha detectado una vulnerabilidad de omisión de autenticación en la interfaz web del firmware de Lenovo Fan Power Controller2 (FPC2) y Lenovo System Management Module (SMM) que podría permitir a un atacante no autenticado ejecutar com... • https://support.lenovo.com/us/en/product_security/LEN-72615 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-4879
https://notcve.org/view.php?id=CVE-2020-4879
21 Jan 2022 — IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could allow a remote attacker to bypass security restrictions, caused by improper validation of authentication cookies. IBM X-Force ID: 190847. IBM Cognos Controller versiones 10.4.0, 10.4.1 y 10.4.2, podrían permitir a un atacante remoto omitir las restricciones de seguridad, causadas por una comprobación incorrecta de las cookies de autenticación. IBM X-Force ID: 190847 • https://exchange.xforce.ibmcloud.com/vulnerabilities/190847 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-4877
https://notcve.org/view.php?id=CVE-2020-4877
21 Jan 2022 — IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 could be vulnerable to unauthorized modifications by using public fields in public classes. IBM X-Force ID: 190843. IBM Cognos Controller versiones 10.4.0, 10.4.1 y 10.4.2, podrían ser vulnerables a modificaciones no autorizadas al usar campos públicos en clases públicas. IBM X-Force ID: 190843 • https://exchange.xforce.ibmcloud.com/vulnerabilities/190843 • CWE-863: Incorrect Authorization •
CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 0CVE-2020-4876
https://notcve.org/view.php?id=CVE-2020-4876
21 Jan 2022 — IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 190839. IBM Cognos Controller versiones 10.4.0, 10.4.1 y 10.4.2, son vulnerables a un ataque de tipo XML External Entity Injection (XXE) cuando son procesados datos XML. Un atacante remoto podría aprovechar esta vulnerabilidad para exponer inform... • https://exchange.xforce.ibmcloud.com/vulnerabilities/190839 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 0CVE-2020-4875
https://notcve.org/view.php?id=CVE-2020-4875
21 Jan 2022 — IBM Cognos Controller 10.4.0, 10.4.1, and 10.4.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 190838. IBM Cognos Controller versiones 10.4.0, 10.4.1 y 10.4.2, son vulnerables a un ataque de tipo XML External Entity Injection (XXE) cuando son procesados datos XML. Un atacante remoto podría aprovechar esta vulnerabilidad para exponer inform... • https://exchange.xforce.ibmcloud.com/vulnerabilities/190838 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.8EPSS: 0%CPEs: 12EXPL: 0CVE-2021-29873
https://notcve.org/view.php?id=CVE-2021-29873
21 Oct 2021 — IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229. IBM Flash System 900 podría permitir a un atacante autenticado conseguir información confidencial y causar una denegación de servicio debido a una vulnerabilidad de escape de shell restringido. IBM X-Force ID: 206229 • https://exchange.xforce.ibmcloud.com/vulnerabilities/206229 •
CVSS: 8.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-4685
https://notcve.org/view.php?id=CVE-2020-4685
11 Nov 2020 — A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos Controller. IBM X-Force ID: 186625. Un usuario de bajo nivel de IBM Cognos Controller versiones 10.3.0, 10.3.1, 10.4.0, 10.4.1 y 10.4.2, que tenga derechos de administración en el servidor donde está instalada la aplicac... • https://exchange.xforce.ibmcloud.com/vulnerabilities/186625 •
CVSS: 8.1EPSS: 0%CPEs: 22EXPL: 0CVE-2020-4686
https://notcve.org/view.php?id=CVE-2020-4686
17 Aug 2020 — IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to. IBM X-Force ID: 186678. IBM Spectrum Virtualize versión 8.3.1, podría permitir a un usuario autenticado remoto por medio de LDAP escalar sus privilegios y realizar acciones a las que no debería tener acceso. IBM X-Force ID: 186678. • https://exchange.xforce.ibmcloud.com/vulnerabilities/186678 •
CVSS: 9.8EPSS: 4%CPEs: 1EXPL: 0CVE-2020-7621
https://notcve.org/view.php?id=CVE-2020-7621
02 Apr 2020 — strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function. strong-nginx-controller versiones hasta 1.0.2, es vulnerable a una Inyección de Comandos. Lo que permite una ejecución de comandos arbitrarios como parte de la función "_nginxCmd()". • https://github.com/strongloop/strong-nginx-controller/blob/master/lib/server.js#L65%2C • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •