CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 0CVE-2015-4963
https://notcve.org/view.php?id=CVE-2015-4963
IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to arbitrary files via unspecified vectors. IBM Security Access Manager for Web 7.x en versiones anteriores a 7.0.0.16 y 8.x en versiones anteriores a 8.0.1.3 no maneja correctamente las peticiones WebSEAL HTTPTransformation, lo que permite a atacantes remotos leer o escribir a archivos arbitrarios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV71196 http://www-01.ibm.com/support/docview.wss?uid=swg21964828 http://www.securitytracker.com/id/1034103 • CWE-17: DEPRECATED: Code •
CVSS: 5.0EPSS: 0%CPEs: 7EXPL: 0CVE-2015-1892
https://notcve.org/view.php?id=CVE-2015-1892
The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets. El contestador Multicast DNS (mDNS) en IBM Security Access Manager for Web 7.x anterior a 7.0.0 FP12 y 8.x anterior a 8.0.1 FP1 responde inadvertidamente a consultas unicast con direcciones de fuentes que no son enlazadas locales, lo que permite a atacantes remotos causar una denegación de servicio (amplificación de trafico) u obtener información potencialmente sensible a través de paquetes UDP del puerto 5353. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV70911 http://www-01.ibm.com/support/docview.wss?uid=swg1IV70913 http://www-01.ibm.com/support/docview.wss?uid=swg21699497 http://www.kb.cert.org/vuls/id/550620 http://www.securityfocus.com/bid/73683 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •