CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-4173
https://notcve.org/view.php?id=CVE-2019-4173
17 Jun 2019 — IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OPTIONS method, aka Optionsbleed. By sending an OPTIONS HTTP request, a remote attacker could exploit this vulnerability to read secret data from process memory and obtain sensitive information. IBM X-Force ID: 158878. IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1 y 10.4.0 podría permitirle a un atacante remoto obtener información confidencial, c... • http://www.ibm.com/support/docview.wss?uid=ibm10886913 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-4136
https://notcve.org/view.php?id=CVE-2019-4136
17 Jun 2019 — IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158332. Las versiones 10.2.0, 10.2.1, 10.3.0, 10.3.1 y 10.4.0 de IBM Cognos Controller son vulnerables a Cross-Site Scripting (XSS). Esta vulnerabilidad permite a los usuarios insertar código JavaSc... • http://www.ibm.com/support/docview.wss?uid=ibm10886913 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 160EXPL: 0CVE-2015-2808 – SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher
https://notcve.org/view.php?id=CVE-2015-2808
01 Apr 2015 — The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue. El algoritmo RC4, utilizado en el protocolo TLS y el prot... • http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •