CVSS: 10.0EPSS: 0%CPEs: 16EXPL: 0CVE-2011-3577
https://notcve.org/view.php?id=CVE-2011-3577
IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.3 does not properly implement Activity Token authentication for Web Services, which has unspecified impact and attack vectors. IBM WebSphere Commerce v6.x a través de v6.0.0.11 y v7.0.0.3 7.x no aplica correctamente la autenticación Activity Token para Web Services, que tienen un impacto no especificado y vectores de ataque. • http://secunia.com/advisories/45999 http://www.ibm.com/support/docview.wss?uid=swg1JR40420 http://www.ibm.com/support/docview.wss?uid=swg24030908 http://www.osvdb.org/75428 http://www.securityfocus.com/bid/49643 https://exchange.xforce.ibmcloud.com/vulnerabilities/69838 • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2010-2639
https://notcve.org/view.php?id=CVE-2010-2639
IBM WebSphere Commerce Enterprise 7.0 before 7.0.0.2 allows remote attackers to read messages intended for other recipients via vectors involving access by the outbound messaging system to the RunTimeProfileCacheCmdImpl class, related to the caching of mutable objects and "concurrency issues." IBM WebSphere Commerce Enterprise 7.0 anteriores 7.0.0.2 permite a atacantes remotos leer mensajes previstos para otros destinatarios a través de vectores que involucran acceso por el sistema de mensajería fuera de línea a la clase RunTimeProfileCacheCmdImpl. Relacionado con el almacenamiento en caché de objetos cambiantes ("mutable") y temas de concurrencia. • http://www-01.ibm.com/support/docview.wss?uid=swg24028397 http://www-1.ibm.com/support/docview.wss?uid=swg1JR38114 http://www.securitytracker.com/id?1024845 https://exchange.xforce.ibmcloud.com/vulnerabilities/63406 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •