CVSS: 3.5EPSS: 0%CPEs: 17EXPL: 0CVE-2014-4814
https://notcve.org/view.php?id=CVE-2014-4814
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. IBM WebSphere Portal 6.1.0 hasta 6.1.0.6 CF27, 6.1.5 hasta 6.1.5.3 CF27, 7.0 hasta 7.0.0.2 CF28, 8.0 hasta 8.0.0.1 CF14, y 8.5.0 anterior a CF03 no detecta debidamente la recursión durante la expansión de entidades, lo que permite a usuarios remotos autenticados causar una denegación de servicio (consumo de memoria y CPU) a través de un documento XML manipulado que contiene un número grande de referencias de entidades anidadas, un problema similar a CVE-2003-1564. • http://secunia.com/advisories/59740 http://www-01.ibm.com/support/docview.wss?uid=swg1PI24622 http://www-01.ibm.com/support/docview.wss?uid=swg21684651 http://www.securityfocus.com/bid/70758 https://exchange.xforce.ibmcloud.com/vulnerabilities/95391 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 17EXPL: 0CVE-2014-4821
https://notcve.org/view.php?id=CVE-2014-4821
IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 provides different web-server error codes depending on whether a requested file exists, which allows remote attackers to determine the validity of filenames via a series of requests. IBM WebSphere Portal 6.1.0 hasta 6.1.0.6 CF27, 6.1.5 hasta 6.1.5.3 CF27, 7.0 hasta 7.0.0.2 CF28, 8.0 hasta 8.0.0.1 CF14, y 8.5.0 anterior a CF03 proporciona códigos de error del servidor web diferentes dependiendo de si un fichero solicitado existe, lo que permite a atacantes remotos determinar la validez de nombres de ficheros a través de una serie de solicitudes. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI27710 http://www-01.ibm.com/support/docview.wss?uid=swg21684651 http://www.securityfocus.com/bid/70755 https://exchange.xforce.ibmcloud.com/vulnerabilities/95466 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-6116
https://notcve.org/view.php?id=CVE-2014-6116
The Telemetry Component in WebSphere MQ 8.0.0.1 before p000-001-L140910 allows remote attackers to bypass authentication by setting the JAASConfig property in an MQTT client configuration. El componente Telemetry en WebSphere MQ 8.0.0.1 anterior a p000-001-L140910 permite a atacantes remotos evadir la autenticación estableciendo la propiedad JAASConfig en una configuración de cliente MQTT. • http://secunia.com/advisories/61064 http://www-01.ibm.com/support/docview.wss?uid=swg21686210 https://exchange.xforce.ibmcloud.com/vulnerabilities/96213 • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 0%CPEs: 57EXPL: 0CVE-2014-3021
https://notcve.org/view.php?id=CVE-2014-3021
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properly handle HTTP headers, which allows remote attackers to obtain sensitive cookie and authentication data via an unspecified HTTP method. IBM WebSphere Application Server (WAS) 7.0 anterior a 7.0.0.35, 8.0 anterior a 8.0.0.10, y 8.5 anterior a 8.5.5.4 no maneja correctamente las cabeceras HTTP, lo que permite a atacantes remotos obtener datos sensibles de cookies y la autenticación a través de un método HTTP no especificado. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI08268 http://www-01.ibm.com/support/docview.wss?uid=swg21684612 https://exchange.xforce.ibmcloud.com/vulnerabilities/93059 • CWE-20: Improper Input Validation •
CVSS: 1.9EPSS: 0%CPEs: 8EXPL: 0CVE-2014-4822
https://notcve.org/view.php?id=CVE-2014-4822
IBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allow local users to discover preconfigured cleartext passwords via an unspecified trace operation. IBM WebSphere MQ classes for Java libraries 8.0 anterior a 8.0.0.1 y Websphere MQ Explorer 7.5 anterior a 7.5.0.5 y 8.0 anterior a 8.0.0.2 permiten a usuarios locales descubrir contraseñas en texto plano preconfiguradas a través de una operación de trazar no especificada. • http://secunia.com/advisories/59921 http://www-01.ibm.com/support/docview.wss?uid=swg1IT04023 http://www-01.ibm.com/support/docview.wss?uid=swg21686339 https://exchange.xforce.ibmcloud.com/vulnerabilities/95467 • CWE-255: Credentials Management Errors •