CVSS: 8.2EPSS: 0%CPEs: 11EXPL: 0CVE-2017-1322
https://notcve.org/view.php?id=CVE-2017-1322
IBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125918. IBM API Connect 5.0.6.0 es vulnerable a un ataque XML External Entity Injection (XXE) al procesar datos XML. Un atacante remoto podría explotar esta vulnerabilidad para exponer información altamente sensible o consumir recursos de la memoria. • http://www.ibm.com/support/docview.wss?uid=swg22003621 http://www.securityfocus.com/bid/99258 https://exchange.xforce.ibmcloud.com/vulnerabilities/125918 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2017-1379
https://notcve.org/view.php?id=CVE-2017-1379
IBM API Connect 5.0.0.0 could allow a remote attacker to obtain sensitive information, caused by improper handling of requests to the Developer Portal. IBM X-Force ID: 127002. IBM API Connect versión 5.0.0.0, podría permitir a un atacante remoto obtener información confidencial, causado por el manejo inapropiado de las peticiones hacia el Portal del Desarrollador. ID de IBM X-Force: 127002. • http://www.ibm.com/support/docview.wss?uid=swg22004714 http://www.securityfocus.com/bid/99063 https://exchange.xforce.ibmcloud.com/vulnerabilities/127002 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1161
https://notcve.org/view.php?id=CVE-2017-1161
IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. By crafting a malicious URL, an attacker could exploit this vulnerability to execute arbitrary commands on the system with the privileges of the www-data user. IBM X-Force ID: 122956. IBM API Connect 5.0.6.0 podría permitir a un atacante remoto ejecutar comandos arbitrarios en el sistema, causados por una validación incorrecta de las URL del Developer Portal. Al crear URLs malintencionadas, un atacante podría explotar esta vulnerabilidad para ejecutar comandos arbitrarios en el sistema con los privilegios del usuario de datos www-data user. • http://www.ibm.com/support/docview.wss?uid=swg22000316 http://www.securityfocus.com/bid/97665 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-3012
https://notcve.org/view.php?id=CVE-2016-3012
IBM API Connect (aka APIConnect) before 5.0.3.0 with NPM before 2.2.8 includes certain internal server credentials in the software package, which might allow remote attackers to bypass intended access restrictions by leveraging knowledge of these credentials. IBM API Connect (también conocido como APIConnect) en versiones anteriores a 5.0.3.0 con NPM en versiones anteriores a 2.2.8 incluye ciertas credenciales de servidor interno en el paquete de software, lo que podría permitir a atacantes remotos eludir las restricciones destinadas al acceso aprovechando el conocimiento de esas credenciales. • http://www-01.ibm.com/support/docview.wss?uid=swg21988212 http://www.securityfocus.com/bid/92417 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 0CVE-2016-1000232 – nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons
https://notcve.org/view.php?id=CVE-2016-1000232
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0. NodeJS Tough-Cookie 2.2.2 contiene una vulnerabilidad de análisis de expresiones regulares en el análisis de la cabecera de cookie de petición HTTP que puede resultar en una denegación de servicio (DoS). Este ataque parece ser explotable mediante una cabecera HTTP personalizada pasada por el cliente. • https://access.redhat.com/errata/RHSA-2016:2101 https://access.redhat.com/errata/RHSA-2017:2912 https://access.redhat.com/security/cve/cve-2016-1000232 https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534 https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232 https://www.npmjs.c • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •