CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2022-38723
https://notcve.org/view.php?id=CVE-2022-38723
Gravitee API Management before 3.15.13 allows path traversal through HTML injection. Gravitee API Management anterior a 3.15.13 permite path traversal mediante inyección de HTML. • https://community.gravitee.io/t/whats-new-in-access-management-3-15-lts/164 https://gist.github.com/garatc/d86cdb1fa2e35a7ee719d9a0de0b5ca3 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2015-0149
https://notcve.org/view.php?id=CVE-2015-0149
The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs, which allows remote authenticated users to obtain sensitive information or modify data via unspecified API calls. El portal Developer en IBM API Management 3.0 anterior a 3.0.4.1 no restringe correctamente el acceso a las APIs públicas y privadas, lo que permite a usuarios remotos autenticados obtener información sensible o modificar datos a través de llamadas a APIs no especificadas. • http://www-01.ibm.com/support/docview.wss?uid=swg1LI78430 http://www-01.ibm.com/support/docview.wss?uid=swg21696693 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2014-6172
https://notcve.org/view.php?id=CVE-2014-6172
IBM API Management 3.0 before 3.0.4.0 IF1 allows remote attackers to obtain sensitive analytics information in an encrypted form via unspecified vectors. IBM API Management 3.0 anterior a 3.0.4.0 IF1 permite a atacantes remotos obtener información sensible de analíticas de manera cifrada a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1LI78291 http://www-01.ibm.com/support/docview.wss?uid=swg21694460 http://www.securitytracker.com/id/1031613 https://exchange.xforce.ibmcloud.com/vulnerabilities/98417 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •