CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-6163
https://notcve.org/view.php?id=CVE-2014-6163
Cross-site scripting (XSS) vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en el dispositivo IBM WebSphere DataPower XC10 2.1 y 2.5 anterior a FP4 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1IT04614 http://www-01.ibm.com/support/docview.wss?uid=swg21691035 https://exchange.xforce.ibmcloud.com/vulnerabilities/97712 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2014-3058
https://notcve.org/view.php?id=CVE-2014-3058
Cross-site request forgery (CSRF) vulnerability on the IBM WebSphere DataPower XC10 appliance 2.1 and 2.5 before FP4 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. Vulnerabilidad de CSRF en el dispositivo IBM WebSphere DataPower XC10 2.1 y 2.5 anterior a FP4 permite a usuarios remotos autenticados secuestrar la autenticación de usuarios arbitrarios para solicitudes que insertan secuencias de XSS. • http://www-01.ibm.com/support/docview.wss?uid=swg1IT04614 http://www-01.ibm.com/support/docview.wss?uid=swg21691035 https://exchange.xforce.ibmcloud.com/vulnerabilities/93532 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2014-6114
https://notcve.org/view.php?id=CVE-2014-6114
The Hosted Transparent Decision Service in the Rule Execution Server in IBM WebSphere ILOG JRules 7.1 before MP1 FP5 IF43; WebSphere Operational Decision Management 7.5 before FP3 IF41; and Operational Decision Manager 8.0 before MP1 FP2 IF34, 8.5 before MP1 FP1 IF43, and 8.6 before IF8 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. El servicio Hosted Transparent Decision en el servidor de la ejecución de reglas en IBM WebSphere ILOG JRules 7.1 anterior a MP1 FP5 IF43; WebSphere Operational Decision Management 7.5 anterior a FP3 IF41; y Operational Decision Manager 8.0 anterior a MP1 FP2 IF34, 8.5 anterior a MP1 FP1 IF43, y 8.6 anterior a IF8 permite a atacantes remotos leer ficheros arbitrarios a través de una declaración de entidad externa XML en conjunto con una referencia de entidad, relacionado con un problema de entidad externa XML (XXE). • http://www-01.ibm.com/support/docview.wss?uid=swg21691815 https://exchange.xforce.ibmcloud.com/vulnerabilities/96211 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2014-6196
https://notcve.org/view.php?id=CVE-2014-6196
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSphere Portal configuration, leading to improper construction of a response page by an application. Vulnerabilidad de XSS en IBM Web Experience Factory (WEF) 6.1.5 hasta 8.5.0.1, utilizado en WebSphere Dashboard Framework (WDF) y Lotus Widget Factory (LWF), permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios mediante el aprovechamiento de un error del constructor Dojo en una configuración no especificada de WebSphere Portal, que conduce a la construcción indebida de una página de respuestas de parte de una aplicación. • http://secunia.com/advisories/59546 http://www-01.ibm.com/support/docview.wss?uid=swg1LO82672 http://www-01.ibm.com/support/docview.wss?uid=swg1LO82673 http://www-01.ibm.com/support/docview.wss?uid=swg1LO82674 http://www-01.ibm.com/support/docview.wss?uid=swg1LO82675 http://www-01.ibm.com/support/docview.wss? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 6EXPL: 0CVE-2014-6093
https://notcve.org/view.php?id=CVE-2014-6093
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en IBM WebSphere Portal 7.0.x anterior a 7.0.0.2 CF29, 8.0.x hasta 8.0.0.1 CF14, y 8.5.x anterior a 8.5.0 CF02 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. • http://secunia.com/advisories/59752 http://secunia.com/advisories/60912 http://www-01.ibm.com/support/docview.wss?uid=swg1PI24678 http://www-01.ibm.com/support/docview.wss?uid=swg21689849 http://www.securitytracker.com/id/1031359 https://exchange.xforce.ibmcloud.com/vulnerabilities/95921 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •