CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0838
https://notcve.org/view.php?id=CVE-2014-0838
The AutoUpdate package before 6.4 for IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to execute arbitrary console commands by leveraging control of the server. El paquete de actualización automática anterior a 6.4 para IBM Security QRadar SIEM 7.2 MR1 y anteriores permite a atacantes remotos ejecutar comandos arbitrarios mediante el aprovechamiento de la consola de control del servidor. • http://osvdb.org/102553 http://www-01.ibm.com/support/docview.wss?uid=swg21663066 http://www.securityfocus.com/bid/65127 https://exchange.xforce.ibmcloud.com/vulnerabilities/90681 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0836
https://notcve.org/view.php?id=CVE-2014-0836
Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en IBM Security QRadar SIEM 7.2 MR1 y anteriores versiones permiten a atacantes remotos inyectar script Web o HTML arbitrario a través de una URL manipulada. • http://osvdb.org/102555 http://seclists.org/fulldisclosure/2014/Jan/166 http://secunia.com/advisories/56653 http://www-01.ibm.com/support/docview.wss?uid=swg21663066 http://www.securityfocus.com/bid/65127 https://exchange.xforce.ibmcloud.com/vulnerabilities/90679 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0837
https://notcve.org/view.php?id=CVE-2014-0837
The AutoUpdate process in IBM Security QRadar SIEM 7.2 MR1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. El proceso de actualización automática de IBM Security QRadar SIEM 7.2 y anteriores no verifica los certificados X.509 de servidores SSL, que permite a atacantes man-in-the-middle falsificar servidores a través de un certificado diseñado. • http://osvdb.org/102552 http://seclists.org/fulldisclosure/2014/Jan/166 http://secunia.com/advisories/56653 http://www-01.ibm.com/support/docview.wss?uid=swg21663066 http://www.securityfocus.com/bid/65127 https://exchange.xforce.ibmcloud.com/vulnerabilities/90680 • CWE-310: Cryptographic Issues •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0835
https://notcve.org/view.php?id=CVE-2014-0835
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings. Vulnerabilidad de CSRF en IBM Security QRadar SIEM 7.2 MR1 y anteriores versiones permiten a atacantes remotos secuestrar la autenticación de administradores para peticiones que modifiquen las opciones de la consola Auto Update. • http://osvdb.org/102554 http://seclists.org/fulldisclosure/2014/Jan/166 http://secunia.com/advisories/56653 http://thomaspollet.blogspot.be/2014/01/ibm-qradar-siem-csrf-xss-mitm-rce.html http://www-01.ibm.com/support/docview.wss?uid=swg21663066 http://www.securityfocus.com/bid/65127 https://exchange.xforce.ibmcloud.com/vulnerabilities/90678 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2013-5448
https://notcve.org/view.php?id=CVE-2013-5448
Cross-site scripting (XSS) vulnerability in the Right Click Plugin context menus in IBM Security QRadar SIEM 7.1 and 7.2 before 7.2 MR1 Patch 1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en los menús de contexto Right Click Plugin de IBM Security QRadar SIEM 7.1 y 7.2 anterior a la versión 7.2 MR1 Patch 1 permite a usuarios remotos autenticados inyectar script web o HTML arbitrario a través de vectores sin especificar. • http://www-01.ibm.com/support/docview.wss?uid=swg21656875 http://www.securityfocus.com/bid/63938 https://exchange.xforce.ibmcloud.com/vulnerabilities/87912 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •