CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2024-22318 – IBM i Access Client Solutions information disclosure
https://notcve.org/view.php?id=CVE-2024-22318
IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user's session. The hostile server could capture the NTLM hash information to obtain the user's credentials. IBM X-Force ID: 279091. IBM i Access Client Solutions (ACS) 1.1.2 a 1.1.4 y 1.1.4.3 a 1.1.9.4 es vulnerable a la divulgación de hash de NT LAN Manager (NTLM) por parte de un atacante que modifica rutas con capacidad UNC dentro de los ACS archivos de configuración para apuntar a un servidor hostil. • https://www.exploit-db.com/exploits/51817 http://packetstormsecurity.com/files/177069/IBM-i-Access-Client-Solutions-Remote-Credential-Theft.html http://seclists.org/fulldisclosure/2024/Feb/7 https://exchange.xforce.ibmcloud.com/vulnerabilities/279091 https://www.ibm.com/support/pages/node/7116091 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-384: Session Fixation •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-45185 – IBM i Access Client Solutions code execution
https://notcve.org/view.php?id=CVE-2023-45185
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Due to improper authority checks the attacker could perform operations on the PC under the user's authority. IBM X-Force ID: 268273. IBM i Access Client Solutions versiones 1.1.2 a 1.1.4 y 1.1.4.3 a 1.1.9.3 podrían permitir a un atacante ejecutar código remoto. Debido a controles de autoridad inadecuados, el atacante podría realizar operaciones en la PC bajo la autoridad del usuario. • https://github.com/afine-com/CVE-2023-45185 https://exchange.xforce.ibmcloud.com/vulnerabilities/268273 https://www.ibm.com/support/pages/node/7091942 • CWE-863: Incorrect Authorization •
CVSS: 7.4EPSS: 0%CPEs: 2EXPL: 1CVE-2023-45182 – IBM i Access Client Solutions information disclosure
https://notcve.org/view.php?id=CVE-2023-45182
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow gaining access to the encrypted password, a local attacker could exploit this vulnerability to obtain the password to other systems. IBM X-Force ID: 268265. IBM i Access Client Solutions 1.1.2 a 1.1.4 y 1.1.4.3 a 1.1.9.3 es vulnerable a que se decodifique su clave para una contraseña cifrada. Al obtener acceso de alguna manera a la contraseña cifrada, un atacante local podría aprovechar esta vulnerabilidad para obtener la contraseña de otros sistemas. • https://github.com/afine-com/CVE-2023-45182 https://exchange.xforce.ibmcloud.com/vulnerabilities/268265 https://www.ibm.com/support/pages/node/7091942 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-45184 – IBM i Access Client Solutions
https://notcve.org/view.php?id=CVE-2023-45184
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. IBM X-Force ID: 268270. IBM i Access Client Solutions versiones 1.1.2 a 1.1.4 y 1.1.4.3 a 1.1.9.3 podrían permitir a un atacante obtener una clave de descifrado debido a comprobaciones de autoridad inadecuadas. ID de IBM X-Force: 268270. • https://github.com/afine-com/CVE-2023-45184 https://exchange.xforce.ibmcloud.com/vulnerabilities/268270 https://www.ibm.com/support/pages/node/7091942 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2022-40746
https://notcve.org/view.php?id=CVE-2022-40746
IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236581. IBM i Access Family 1.1.2 a 1.1.4 y 1.1.4.3 a 1.1.9.0 podría permitir que un atacante autenticado local ejecute código arbitrario en el sistema, causado por una vulnerabilidad de secuestro de orden de búsqueda de DLL. Al colocar un archivo especialmente manipulado en una carpeta comprometida, un atacante podría aprovechar esta vulnerabilidad para ejecutar código arbitrario en el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/236581 https://www.ibm.com/support/pages/node/6840359 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-427: Uncontrolled Search Path Element •