CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-45190 – IBM Engineering Lifecycle Optimization HTTP header injection
https://notcve.org/view.php?id=CVE-2023-45190
IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 268754. IBM Engineering Lifecycle Optimization 7.0.2 y 7.0.3 es vulnerable a la inyección de encabezados HTTP, causada por una validación incorrecta de la entrada por parte de los encabezados HOST. Esto podría permitir que un atacante realice varios ataques contra el sistema vulnerable, incluido cross-site scripting, envenenamiento de caché o secuestro de sesión. • https://exchange.xforce.ibmcloud.com/vulnerabilities/268754 https://www.ibm.com/support/pages/node/7116045 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-45187 – IBM Engineering Lifecycle Optimization - Publishing session fixation
https://notcve.org/view.php?id=CVE-2023-45187
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 268749. IBM Engineering Lifecycle Optimization: las publicaciones 7.0.2 y 7.0.3 no invalidan la sesión después del cierre de sesión, lo que podría permitir que un usuario autenticado se haga pasar por otro usuario en el sistema. ID de IBM X-Force: 268749. • https://exchange.xforce.ibmcloud.com/vulnerabilities/268749 https://www.ibm.com/support/pages/node/7116045 • CWE-613: Insufficient Session Expiration •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2024-22318 – IBM i Access Client Solutions information disclosure
https://notcve.org/view.php?id=CVE-2024-22318
IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user's session. The hostile server could capture the NTLM hash information to obtain the user's credentials. IBM X-Force ID: 279091. IBM i Access Client Solutions (ACS) 1.1.2 a 1.1.4 y 1.1.4.3 a 1.1.9.4 es vulnerable a la divulgación de hash de NT LAN Manager (NTLM) por parte de un atacante que modifica rutas con capacidad UNC dentro de los ACS archivos de configuración para apuntar a un servidor hostil. • https://www.exploit-db.com/exploits/51817 http://packetstormsecurity.com/files/177069/IBM-i-Access-Client-Solutions-Remote-Credential-Theft.html http://seclists.org/fulldisclosure/2024/Feb/7 https://exchange.xforce.ibmcloud.com/vulnerabilities/279091 https://www.ibm.com/support/pages/node/7116091 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-384: Session Fixation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47700 – IBM Storage Virtualize improper certificate validation
https://notcve.org/view.php?id=CVE-2023-47700
IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that would not be correctly validated by the Storwize server. This could lead to a user connecting to a malicious host, believing that it was a trusted system and deceived into accepting spoofed data. IBM X-Force ID: 271016. Los productos IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem e IBM Storage Virtualize 8.6 podrían permitir a un atacante remoto falsificar un sistema confiable que no sería validado correctamente por el servidor Storwize. Esto podría llevar a que un usuario se conecte a un host malicioso, creyendo que se trata de un sistema confiable y siendo engañado para que acepte datos falsificados. • https://exchange.xforce.ibmcloud.com/vulnerabilities/271016 https://www.ibm.com/support/pages/node/7114767 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-38369 – IBM Security Access Manager Container information disclosure
https://notcve.org/view.php?id=CVE-2023-38369
IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196. IBM Security Access Manager Container 10.0.0.0 a 10.0.6.1 no requiere que las imágenes de Docker tengan contraseñas seguras de forma predeterminada, lo que facilita que los atacantes comprometan las cuentas de usuario. ID de IBM X-Force: 261196. IBM Security Verify Access versions prior to 10.0.8 suffer from authentication bypass, reuse of private keys, local privilege escalation, weak settings, outdated libraries, missing password, hardcoded secrets, remote code execution, missing authentication, null pointer dereference, and lack of privilege separation vulnerabilities. • https://exchange.xforce.ibmcloud.com/vulnerabilities/261196 https://www.ibm.com/support/pages/node/7106586 • CWE-521: Weak Password Requirements •