CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-38363 – IBM CICS TX information disclosure
https://notcve.org/view.php?id=CVE-2023-38363
IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 260818. [PROBLEMTYPE] en [COMPONENT] en [VENDOR] [PRODUCT] [VERSION] en [PLATFORMS] permite que [ATTACKER] [IMPACT] a través de [VECTOR] • https://exchange.xforce.ibmcloud.com/vulnerabilities/260818 https://www.ibm.com/support/pages/node/7067987 •
CVSS: 5.4EPSS: 0%CPEs: 8EXPL: 0CVE-2023-43057 – IBM QRadar SIEM cross-site scripting
https://notcve.org/view.php?id=CVE-2023-43057
IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 267484. IBM QRadar SIEM 7.5.0 es vulnerable a cross-site scripting. Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista, lo que podría conducir a la divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/267484 https://www.ibm.com/support/pages/node/7070736 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2023-45167 – IBM AIX denial of service
https://notcve.org/view.php?id=CVE-2023-45167
IBM AIX's 7.3 Python implementation could allow a non-privileged local user to exploit a vulnerability to cause a denial of service. IBM X-Force ID: 267965. La implementación Python 7.3 de IBM AIX podría permitir que un usuario local sin privilegios aproveche una vulnerabilidad para provocar una denegación de servicio. ID de IBM X-Force: 267965. • https://aix.software.ibm.com/aix/efixes/security/python_advisory6.asc https://exchange.xforce.ibmcloud.com/vulnerabilities/267965 https://www.ibm.com/support/pages/node/7068084 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-45189 – IBM Robotic Process Automation information disclosure
https://notcve.org/view.php?id=CVE-2023-45189
A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result in access to client vault credentials. This difficult to exploit vulnerability could allow a low privileged attacker to programmatically access client vault credentials. IBM X-Force ID: 268752. Una vulnerabilidad en IBM Robotic Process Automation e IBM Robotic Process Automation para Cloud Pak 21.0.0 a 21.0.7.10, 23.0.0 a 23.0.10 puede provocar acceso a las credenciales de la bóveda del cliente. Esta vulnerabilidad difícil de explotar podría permitir que un atacante con pocos privilegios acceda mediante programación a las credenciales de la bóveda del cliente. • https://exchange.xforce.ibmcloud.com/vulnerabilities/268752 https://www.ibm.com/support/pages/node/7065204 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2023-35896 – IBM Content Navigator server-side request forgery
https://notcve.org/view.php?id=CVE-2023-35896
IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 259247. IBM Content Navigator 3.0.13 es vulnerable a server-side request forgery (SSRF). Esto puede permitir que un atacante autenticado envíe solicitudes no autorizadas desde el sistema, lo que podría provocar la enumeración de la red o facilitar otros ataques. • https://exchange.xforce.ibmcloud.com/vulnerabilities/259247 https://www.ibm.com/support/pages/node/7065203 • CWE-918: Server-Side Request Forgery (SSRF) •