CVSS: 10.0EPSS: 0%CPEs: 9EXPL: 0CVE-2023-23477 – IBM WebSphere Application Server code execution
https://notcve.org/view.php?id=CVE-2023-23477
03 Feb 2023 — IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. IBM X-Force ID: 245513. • https://exchange.xforce.ibmcloud.com/vulnerabilities/245513 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-43917 – IBM WebSphere Application Server information disclosure
https://notcve.org/view.php?id=CVE-2022-43917
25 Jan 2023 — IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information. This affects only the containerized version of WebSphere Application Server traditional. IBM X-Force ID: 241045. El contenedor tradicional IBM WebSphere Application Server 8.5 y 9.0 utiliza claves criptográficas más débiles de lo esperado que podrían permitir a un atacante descifrar información confidencial. Esto afecta sólo a la versi... • https://exchange.xforce.ibmcloud.com/vulnerabilities/241045 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-43860 – IBM Navigator for i SQL injection
https://notcve.org/view.php?id=CVE-2022-43860
22 Dec 2022 — IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authorized to but not while using this interface. By performing an SQL injection an attacker could see user profile attributes through this interface. IBM X-Force ID: 239305. IBM Navigator para i 7.3, 7.4 y 7.5 podría permitir que un usuario autenticado obtenga información confidencial a la que está autorizado pero no mientras utiliza esta interfaz. Al realizar una inyección SQL, un atacante podr... • https://exchange.xforce.ibmcloud.com/vulnerabilities/239305 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-43859 – IBM Navigator for i SQL injection
https://notcve.org/view.php?id=CVE-2022-43859
22 Dec 2022 — IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information for an object they are authorized to but not while using this interface. By performing a UNION based SQL injection an attacker could see file permissions through this interface. IBM X-Force ID: 239304. IBM Navigator para i 7.3, 7.4 y 7.5 podría permitir a un usuario autenticado obtener información confidencial para un objeto para el que está autorizado pero no mientras utiliza esta interfaz. Al realizar u... • https://exchange.xforce.ibmcloud.com/vulnerabilities/239304 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-43858 – IBM Navigator for i information disclosure
https://notcve.org/view.php?id=CVE-2022-43858
22 Dec 2022 — IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to access the file system and download files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks by modifying a parameter thereby gaining access to their files through this interface. IBM X-Force ID: 239303. IBM Navigator para i 7.3, 7.4 y 7.5 podría permitir que un usuario autenticado acceda al sistema de archivos y descargue archivos para los que está autorizado, per... • https://exchange.xforce.ibmcloud.com/vulnerabilities/239303 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-43857 – IBM Navigator for i information disclosure
https://notcve.org/view.php?id=CVE-2022-43857
22 Dec 2022 — IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this interface. The remote authenticated user can bypass the interface checks and download log files by modifying servlet filter. IBM X-Force ID: 239301. IBM Navigator para i 7.3, 7.4 y 7.5 podría permitir que un usuario autenticado acceda a los archivos de registro i de IBM Navigator para los que está autorizado pero no mientras utiliza esta interfaz. El ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/239301 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2022-40746
https://notcve.org/view.php?id=CVE-2022-40746
21 Nov 2022 — IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236581. IBM i Access Family 1.1.2 a 1.1.4 y 1.1.4.3 a 1.1.9.0 podría permitir que un atacante autenticado local ejecute código arbitrario en el s... • https://exchange.xforce.ibmcloud.com/vulnerabilities/236581 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-427: Uncontrolled Search Path Element •
CVSS: 6.8EPSS: 0%CPEs: 13EXPL: 0CVE-2022-31772 – IBM MQ denial of service
https://notcve.org/view.php?id=CVE-2022-31772
11 Nov 2022 — IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. IBM X-Force ID: 228335. IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD y 9.2 LTS podrían permitir que un usuario autenticado y autorizado provoque una denegación de servicio a los canales MQTT. ID de IBM X-Force: 228335. • https://exchange.xforce.ibmcloud.com/vulnerabilities/228335 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-40750 – IBM WebSphere Application Server cross-site scripting
https://notcve.org/view.php?id=CVE-2022-40750
11 Nov 2022 — IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236588. IBM WebSphere Application Server 8.5 y 9.0 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando... • https://exchange.xforce.ibmcloud.com/vulnerabilities/236588 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 11EXPL: 0CVE-2022-38712
https://notcve.org/view.php?id=CVE-2022-38712
03 Nov 2022 — "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762." "IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 podrían permitir que un atacante intermediario realice suplantación de SOAPAction para ejecutar operaciones no deseadas o no autorizadas. ID de IBM X-Force: 234762". • https://www.ibm.com/support/pages/node/6829907 • CWE-290: Authentication Bypass by Spoofing •