CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2013-3980
https://notcve.org/view.php?id=CVE-2013-3980
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to cause a denial of service (room unusability) by generating a large number of fictitious users to enter a meeting room. Meeting Server en IBM Sametime 8.x hasta 8.5.2.1 y 9.x hasta 9.0.0.1 permite a atacantes remotos causar una denegación de servicio (inutilizabilidad de aula) mediante la generación de un número grande de usuarios ficticios apara entrar en una aula de reunión. • http://www-01.ibm.com/support/docview.wss?uid=swg21671201 https://exchange.xforce.ibmcloud.com/vulnerabilities/84906 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 0CVE-2014-0906
https://notcve.org/view.php?id=CVE-2014-0906
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not check whether a session cookie is current, which allows remote attackers to conduct user-search actions by leveraging possession of a (1) expired or (2) invalidated cookie. Meeting Server en IBM Sametime 8.x hasta 8.5.2.1 y 9.x hasta 9.0.0.1 no comprueba si una cookie de sesión es actual, lo que permite a atacantes remotos realizar acciones de búsqueda de usuario mediante el aprovechamiento de una cookie (1) caducada o (2) invalidada. • http://www-01.ibm.com/support/docview.wss?uid=swg21671201 https://exchange.xforce.ibmcloud.com/vulnerabilities/91854 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 0CVE-2013-3046
https://notcve.org/view.php?id=CVE-2013-3046
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not send the HSTS Strict-Transport-Security header, which makes it easier for man-in-the-middle attackers to hijack sessions or obtain sensitive information by leveraging the presence of HTTP requests. Meeting Server en IBM Sametime 8.x hasta 8.5.2.1 y 9.x hasta 9.0.0.1 no envía la cabecera HSTS Strict-Transport-Security, lo que facilita a atacantes man-in-the-middle secuestrar sesiones u obtener información sensible mediante el aprovechamiento de la presencia de solicitudes HTTP. • http://www-01.ibm.com/support/docview.wss?uid=swg21671201 https://exchange.xforce.ibmcloud.com/vulnerabilities/84819 • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2013-3981
https://notcve.org/view.php?id=CVE-2013-3981
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote attackers to download avatar photos of arbitrary users via unspecified vectors. Meeting Server en IBM Sametime 8.x hasta 8.5.2.1 y 9.x hasta 9.0.0.1 permite a atacantes remotos descargar fotografías avatar de usuarios arbitrarios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg21671201 https://exchange.xforce.ibmcloud.com/vulnerabilities/84907 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 12EXPL: 0CVE-2014-3014
https://notcve.org/view.php?id=CVE-2014-3014
Cross-site scripting (XSS) vulnerability in the Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en Meeting Server en IBM Sametime 8.x hasta 8.5.2.1 y 9.x hasta 9.0.0.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg21671201 http://www.securityfocus.com/bid/67597 https://exchange.xforce.ibmcloud.com/vulnerabilities/93025 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •