CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-22338 – IBM Sterling B2B Integrator Standard Edition SQL injection
https://notcve.org/view.php?id=CVE-2022-22338
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 219510. IBM Sterling B2B Integrator Standard Edition 6.0.0.0 a 6.1.2.1 es vulnerable a la inyección SQL. Un atacante remoto podría enviar declaraciones SQL especialmente manipulada, que podrían permitirle ver, agregar, modificar o eliminar información en la base de datos back-end. • https://exchange.xforce.ibmcloud.com/vulnerabilities/219510 https://www.ibm.com/support/pages/node/6852453 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2022-22371 – IBM Sterling B2B Integrator Standard Edition session fixation
https://notcve.org/view.php?id=CVE-2022-22371
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 221195. IBM Sterling B2B Integrator Standard Edition 6.0.0.0 a 6.1.2.1 no invalida la sesión después de un cambio de contraseña que podría permitir que un usuario autenticado se haga pasar por otro usuario en el sistema. ID de IBM X-Force: 221195. • https://exchange.xforce.ibmcloud.com/vulnerabilities/221195 https://www.ibm.com/support/pages/node/6852461 • CWE-613: Insufficient Session Expiration •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2021-38928 – IBM Sterling B2B Integrator Standard Edition cross-origin resource sharing
https://notcve.org/view.php?id=CVE-2021-38928
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 210323. Las versiones de IBM Sterling B2B Integrator Standard Edition de la 6.0.0.0 a la 6.1.2.1 utiliza el uso compartido de recursos entre orígenes (CORS), lo que podría permitir a un atacante llevar a cabo acciones privilegiadas y recuperar información confidencial, ya que el nombre de dominio no se limita solo a dominios confiables. ID de IBM X-Force: 210323. • https://exchange.xforce.ibmcloud.com/vulnerabilities/210323 https://www.ibm.com/support/pages/node/6852467 •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-43920 – IBM Sterling B2B Integrator Standard Edition privilege escalation
https://notcve.org/view.php?id=CVE-2022-43920
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could allow an authenticated user to gain privileges in a different group due to an access control vulnerability in the Sftp server adapter. IBM X-Force ID: 241362. IBM Sterling B2B Integrator Standard Edition 6.0.0.0 a 6.1.2.1 podría permitir que un usuario autenticado obtenga privilegios en un grupo diferente debido a una vulnerabilidad de control de acceso en el adaptador del servidor Sftp. ID de IBM X-Force: 241362. • https://exchange.xforce.ibmcloud.com/vulnerabilities/241362 https://www.ibm.com/support/pages/node/6852465 •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2022-34330 – IBM Sterling B2B Integrator cross-site scripting
https://notcve.org/view.php?id=CVE-2022-34330
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229469. IBM Sterling B2B Integrator Standard Edition 6.0.0.0 a 6.1.2.1 es vulnerable a cross-site scripting. Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista, lo que podría conducir a la divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/229469 https://www.ibm.com/support/pages/node/6852469 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •