CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-4534
https://notcve.org/view.php?id=CVE-2020-4534
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges. IBM X-Force ID: 182808. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0, podría permitir a un atacante autenticado local alcanzar privilegios elevados sobre el sistema, debido a un manejo inapropiado de las rutas UNC. Al programar una tarea con una ruta UNC especialmente diseñada, un atacante podría explotar esta vulnerabilidad para ejecutar código arbitrario con privilegios elevados. • https://exchange.xforce.ibmcloud.com/vulnerabilities/182808 https://www.ibm.com/support/pages/node/6255074 •
CVSS: 9.8EPSS: 2%CPEs: 4EXPL: 1CVE-2020-4464 – IBM WebSphere Application Server SOAP Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-4464
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0, tradicionalmente podría permitir a un atacante remoto ejecutar código arbitrario en un sistema con una secuencia especialmente diseñada de objetos serializados a través del conector SOAP. IBM X-Force ID: 181489 This vulnerability allows remote attackers to execute arbitrary code on affected installations of IBM WebSphere. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAP protocol. • https://github.com/yonggui-li/CVE-2020-4464-and-CVE-2020-4450 https://exchange.xforce.ibmcloud.com/vulnerabilities/181489 https://www.ibm.com/support/pages/node/6250059 https://www.zerodayinitiative.com/advisories/ZDI-20-878 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 2%CPEs: 4EXPL: 0CVE-2020-4449 – IBM WebSphere Application Server IIOP Deserialization of Untrusted Data Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-4449
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized objects. IBM X-Force ID: 181230. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0 traditional, podría permitir a un atacante remoto obtener información confidencial con una secuencia de objetos serializados especialmente diseñada. ID de IBM X-Force: 181230 This vulnerability allows remote attackers to disclose sensitive information on affected installations of IBM WebSphere. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the IIOP protocol. • https://exchange.xforce.ibmcloud.com/vulnerabilities/181230 https://www.ibm.com/support/pages/node/6220296 https://www.zerodayinitiative.com/advisories/ZDI-20-690 • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-4329
https://notcve.org/view.php?id=CVE-2020-4329
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obtain sensitive information, caused by improper parameter checking. This could be exploited to conduct spoofing attacks. IBM X-Force ID: 177841. IBM WebSphere Application Server versión 7.0, 8.0, 8.5, 9.0 y Liberty versiones 17.0.0.3 hasta 20.0.0.4, podrían permitir a un atacante remoto autentificado obtener información confidencial, causado por la comprobación de parámetros inapropiada. Esto podría ser explotado para llevar a cabo ataques de suplantación de identidad. • https://exchange.xforce.ibmcloud.com/vulnerabilities/177841 https://www.ibm.com/support/pages/node/6201862 •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-4362
https://notcve.org/view.php?id=CVE-2020-4362
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. IBM X-Force ID: 178929. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0 tradicional, es susceptible a una vulnerabilidad de escalada de privilegios cuando se usa una autenticación basada en token en una petición de administrador por medio del conector SOAP. ID de IBM X-Force: 178929. • https://exchange.xforce.ibmcloud.com/vulnerabilities/178929 https://www.ibm.com/support/pages/node/6174417 •