CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-33839 – IBM Security Verify Governance command execution
https://notcve.org/view.php?id=CVE-2023-33839
IBM Security Verify Governance 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 256036. IBM Security Verify Governance 10.0 podría permitir que un atacante remoto autenticado ejecute comandos arbitrarios en el sistema enviando una solicitud especialmente manipulada. ID de IBM X-Force: 256036. • https://exchange.xforce.ibmcloud.com/vulnerabilities/256036 https://www.ibm.com/support/pages/node/7057377 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-22466 – IBM Security Verify Governance information disclosure
https://notcve.org/view.php?id=CVE-2022-22466
IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 225222. IBM Security Verify Governance 10.0 contiene credenciales codificadas, como una contraseña o clave criptográfica, que utiliza para su propia autenticación entrante, comunicación saliente con componentes externos o cifrado de datos internos. ID de IBM X-Force: 225222. • https://exchange.xforce.ibmcloud.com/vulnerabilities/225222 https://www.ibm.com/support/pages/node/7057377 • CWE-798: Use of Hard-coded Credentials •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-33840 – IBM Security Verify Governance cross-site scripting
https://notcve.org/view.php?id=CVE-2023-33840
IBM Security Verify Governance 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 256037. IBM Security Verify Governance 10.0 es vulnerable a cross-site scripting. Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista, lo que podría conducir a la divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/256037 https://www.ibm.com/support/pages/node/7057377 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2023-38722 – IBM Sterling Partner Engagement Manager cross-site scripting
https://notcve.org/view.php?id=CVE-2023-38722
IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 262174. IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0 y 6.2.2 es vulnerable a cross-site scripting almacenado. Esta vulnerabilidad permite a los usuarios incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista, lo que podría conducir a la divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/262174 https://www.ibm.com/support/pages/node/7057407 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-43045 – IBM Sterling Partner Engagement Manager security bypass
https://notcve.org/view.php?id=CVE-2023-43045
IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896. IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0 y 6.2.2 podrían permitir que un usuario remoto realice acciones no autorizadas debido a una autenticación incorrecta. ID de IBM X-Force: 266896. • https://exchange.xforce.ibmcloud.com/vulnerabilities/266896 https://www.ibm.com/support/pages/node/7057409 • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-306: Missing Authentication for Critical Function •