CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-0194
https://notcve.org/view.php?id=CVE-2015-0194
XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read arbitrary files via a crafted XML data. Una vulnerabilidad de tipo XML External Entity (XXE) en las versiones 5.1 y 5.2 de IBM Sterling B2B Integrator y las versiones 2.1 y 2.2 de IBM Sterling File Gateway permite a los atacantes leer archivos arbitrarios utilizando datos XML manipulados. • http://www-01.ibm.com/support/docview.wss?uid=swg1IT06733 http://www-01.ibm.com/support/docview.wss?uid=swg21699482 http://www.securityfocus.com/bid/73401 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2014-6199
https://notcve.org/view.php?id=CVE-2014-6199
The HTTP Server Adapter in IBM Sterling B2B Integrator 5.1 and 5.2.x and Sterling File Gateway 2.1 and 2.2 allows remote attackers to cause a denial of service (connection-slot exhaustion) via a crafted HTTP request. El adaptador del servidor HTTP en IBM Sterling B2B Integrator 5.1 y 5.2.x y Sterling File Gateway 2.1 y 2.2 permite a atacantes remotos causar una denegación de servicio (agotamiento de ranuras de conexión) a través de una solicitud HTTP manipulada. • http://secunia.com/advisories/62082 http://www-01.ibm.com/support/docview.wss?uid=swg1IT05121 http://www-01.ibm.com/support/docview.wss?uid=swg21693131 https://exchange.xforce.ibmcloud.com/vulnerabilities/98650 • CWE-399: Resource Management Errors •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2013-5407
https://notcve.org/view.php?id=CVE-2013-5407
IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements, which allows remote authenticated users to bypass intended access restrictions or obtain sensitive information via a crafted web site, related to a "frame injection" issue. IBM Sterling B2B Integrator 5.2 y Sterling File Gateway 2.2 no restringen apropiadamente el uso de elementos FRAME, lo cual permite a usuarios remotos autenticados sortear restricciones de acceso u obtener información sensible a través de un sitio web manipulado, relacionado con un problema de "frame injection". • http://www-01.ibm.com/support/docview.wss?uid=swg1IC96057 http://www-01.ibm.com/support/docview.wss?uid=swg21657539 https://exchange.xforce.ibmcloud.com/vulnerabilities/87356 • CWE-20: Improper Input Validation •
CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2013-5405
https://notcve.org/view.php?id=CVE-2013-5405
Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters. Múltiples vulnerabilidades cross-site scripting (XSS) en IBM Sterling B2B Integrator 5.2 y Sterling File Gateway 2.2 permiten a usuarios remotos autenticados inyectar script web o HTML de forma arbitraria a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1IC96053 http://www-01.ibm.com/support/docview.wss?uid=swg21657539 http://www.securityfocus.com/bid/64443 https://exchange.xforce.ibmcloud.com/vulnerabilities/87354 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2013-5409
https://notcve.org/view.php?id=CVE-2013-5409
Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Múltiples vulnerabilidades de inyección SQL en IBM Sterling Integrator 5.2 y Sterling File Gateway 2.2 permite a usuarios remotos autenticados ejecutar comandos SQL de forma arbitraria a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1IC96049 http://www-01.ibm.com/support/docview.wss?uid=swg21657539 https://exchange.xforce.ibmcloud.com/vulnerabilities/87358 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •