CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-38273 – IBM Cloud Pak System information disclosure
https://notcve.org/view.php?id=CVE-2023-38273
IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 260733. IBM Cloud Pak System 2.3.1.1, 2.3.2.0 y 2.3.3.7 utiliza una configuración de bloqueo de cuenta inadecuada que podría permitir a un atacante remoto utilizar fuerza bruta en las credenciales de la cuenta. ID de IBM X-Force: 260733. • https://exchange.xforce.ibmcloud.com/vulnerabilities/260733 https://www.ibm.com/support/pages/node/7105357 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47142 – IBM Tivoli Application Dependency Discovery Manager privilege escalation
https://notcve.org/view.php?id=CVE-2023-47142
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization's local network to escalate their privileges due to unauthorized API access. IBM X-Force ID: 270267. IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 a 7.3.0.10 podría permitir que un atacante en la red local de la organización escale sus privilegios debido a un acceso API no autorizado. ID de IBM X-Force: 270267. • https://exchange.xforce.ibmcloud.com/vulnerabilities/270267 https://www.ibm.com/support/pages/node/7105139 • CWE-264: Permissions, Privileges, and Access Controls CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47144 – IBM Tivoli Application Dependency Discovery Manager cross-site scripting
https://notcve.org/view.php?id=CVE-2023-47144
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 270271. IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 a 7.3.0.10 es vulnerable a cross-site scripting. Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista, lo que podría conducir a la divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/270271 https://www.ibm.com/support/pages/node/7105139 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47143 – IBM Tivoli Application Dependency Discovery Manager HOST header injection
https://notcve.org/view.php?id=CVE-2023-47143
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 270270. IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 a 7.3.0.10 es vulnerable a la inyección de encabezados HTTP, causada por una validación incorrecta de la entrada por parte de los encabezados HOST. Esto podría permitir que un atacante realice varios ataques contra el sistema vulnerable, incluido cross-site scripting, envenenamiento de caché o secuestro de sesión. • https://exchange.xforce.ibmcloud.com/vulnerabilities/270270 https://www.ibm.com/support/pages/node/7105139 • CWE-116: Improper Encoding or Escaping of Output CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-47148 – IBM Storage Protect Plus Server information disclosure
https://notcve.org/view.php?id=CVE-2023-47148
IBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper validation of unsecured endpoints which could be used in further attacks against the system. IBM X-Force ID: 270599. IBM Storage Protect Plus Server 10.1.0 a 10.1.15.2 Admin Console podría permitir que un atacante remoto obtenga información confidencial debido a una validación inadecuada de endpoints no seguros que podrían usarse en futuros ataques contra el sistema. ID de IBM X-Force: 270599. • https://exchange.xforce.ibmcloud.com/vulnerabilities/270599 https://www.ibm.com/support/pages/node/7096482 • CWE-862: Missing Authorization •