Page 7 of 183 results (0.014 seconds)

CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0

CVE-2019-4030

https://notcve.org/view.php?id=CVE-2019-4030

06 Mar 2019 — IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155946. IBM WebSphere Application Server, en sus versiones 8.5 y 9.0, es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usua... • http://www.ibm.com/support/docview.wss?uid=ibm10869406 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2018-1996

https://notcve.org/view.php?id=CVE-2018-1996

19 Feb 2019 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration. A remote attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 154650. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 podría proporcionar seguridad más débil de la esperada debido a una configuración TLS incorrecta. Un atacante remoto podría explotar esta vulnerabilidad para obtener informa... • http://www.securityfocus.com/bid/107155 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •

CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2018-1926

https://notcve.org/view.php?id=CVE-2018-1926

12 Dec 2018 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could exploit this vulnerability to perform CSRF attack and update available applications. IBM X-Force ID: 152992. La consola de administrador de IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 es vulnerable a ataques Cro... • http://www.securityfocus.com/bid/106204 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2018-1901

https://notcve.org/view.php?id=CVE-2018-1901

12 Dec 2018 — IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used. IBM X-Force ID: 152530. IBM WebSphere Application Server 8.5 y 9.0 podría permitir que un atacante remoto obtenga temporalmente privilegios elevados en el sistema, provocado por el uso de un valor cacheado incorrectamente. IBM X-Force ID: 152530. • https://exchange.xforce.ibmcloud.com/vulnerabilities/152530 •

CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2018-1904

https://notcve.org/view.php?id=CVE-2018-1904

11 Dec 2018 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. IBM X-Force ID: 152533. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 podría permitir que atacantes remotos ejecuten código Java arbitrario mediante una clase del cliente administrativo con un objeto serializado desde fuentes no fiables. IBM X-Force ID: 152533. • http://www.securityfocus.com/bid/106193 • CWE-502: Deserialization of Untrusted Data •

CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2018-1840

https://notcve.org/view.php?id=CVE-2018-1840

03 Dec 2018 — IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is configured to use a federated repository other than global federated repository and then migrated to a newer release of WebSphere Application Server. IBM X-Force ID: 150813. IBM WebSphere Application Server 8.5 y 9.0 podría permitir que un atacante remoto obtenga privilegios elevados en el sistema. Esto ocurre cuando un dominio de seguridad se configura para ... • http://www.securityfocus.com/bid/106141 • CWE-668: Exposure of Resource to Wrong Sphere •

CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2018-1797

https://notcve.org/view.php?id=CVE-2018-1797

16 Nov 2018 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the system. By persuading a victim to extract a specially-crafted ZIP archive containing "dot dot slash" sequences (../), an attacker could exploit this vulnerability to write to arbitrary files on the system. Note: This vulnerability is known as "Zip-Slip". IBM X-Force ID: 149427. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 empleando Enterprise bund... • http://www.securityfocus.com/bid/105982 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0

CVE-2018-1643

https://notcve.org/view.php?id=CVE-2018-1643

15 Nov 2018 — The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 144588 La herramienta de verificación de instalación de IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabili... • http://www.securityfocus.com/bid/106032 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0

CVE-2018-1798

https://notcve.org/view.php?id=CVE-2018-1798

12 Nov 2018 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 149428. IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de us... • http://www.ibm.com/support/docview.wss?uid=ibm10730703 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0

CVE-2018-1851

https://notcve.org/view.php?id=CVE-2018-1851

31 Oct 2018 — IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted request to the RP service, an attacker could exploit this vulnerability to execute arbitrary code. IBM X-Force ID: 150999. IBM WebSphere Application Server Liberty OpenID Connect podría permitir que un atacante remoto ejecute código arbitrario en el sistema, provocado por una deserialización incorrecta. Un atacante p... • http://www.securityfocus.com/bid/105839 • CWE-502: Deserialization of Untrusted Data •