CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-32338 – IBM Sterling Secure Proxy information disclosure
https://notcve.org/view.php?id=CVE-2023-32338
IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a local user with container access. IBM X-Force ID: 255585. IBM Sterling Secure Proxy e IBM Sterling External Authentication Server v6.0.3 y v6.1.0 almacenan credenciales de usuario en texto claro que puede leer un usuario local con acceso al contenedor. IBM X-Force ID: 255585. • https://exchange.xforce.ibmcloud.com/vulnerabilities/255585 https://https://www.ibm.com/support/pages/node/7029765 https://www.ibm.com/support/pages/node/7029765 https://www.ibm.com/support/pages/node/7029766 • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-35720 – IBM Sterling External Authentication Server information disclosure
https://notcve.org/view.php?id=CVE-2022-35720
IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation that could allow a local attacker to decrypt sensitive information. IBM X-Force ID: 231373. • https://www.ibm.com/support/pages/node/6890663 https://www.ibm.com/support/pages/node/6890669 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-29726
https://notcve.org/view.php?id=CVE-2021-29726
IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is actually associated with the host due to improper validation of certificates. IBM X-Force ID: 201104. IBM Sterling Secure Proxy versión 6.0.3 e IBM Secure External Authentication Server versión 6.0.3, no garantizan apropiadamente que un certificado esté realmente asociado con el host debido a una comprobación incorrecta de los certificados. IBM X-Force ID: 201104 • https://exchange.xforce.ibmcloud.com/vulnerabilities/201104 https://www.ibm.com/support/pages/node/6586754 https://www.ibm.com/support/pages/node/6586756 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-22336
https://notcve.org/view.php?id=CVE-2022-22336
IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing a denial of service due to a resource leak. IBM X-Force ID: 219395. IBM Sterling External Authentication Server e IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0 y 3.4.3.2 podrían permitir a un usuario remoto consumir recursos causando una denegación de servicio debido a una fuga de recursos. ID de IBM X-Force: 219395 • https://exchange.xforce.ibmcloud.com/vulnerabilities/219395 https://www.ibm.com/support/pages/node/6558796 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-22333
https://notcve.org/view.php?id=CVE-2022-22333
IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow, due to the Jetty based GUI in the Secure Zone not properly validating the sizes of the form content and/or HTTP headers submitted. A local attacker positioned inside the Secure Zone could submit a specially crafted HTTP request to disrupt service. IBM X-Force ID: 219133. IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, y 3.4.3.2 e IBM Sterling External Authentication Server son vulnerables a un desbordamiento de búfer, debido a que la interfaz gráfica de usuario basada en Jetty en la Secure Zone no valida correctamente los tamaños del contenido del formulario y/o las cabeceras HTTP enviadas. Un atacante local situado dentro de la Zona Segura podría enviar una solicitud HTTP especialmente diseñada para interrumpir el servicio. • https://exchange.xforce.ibmcloud.com/vulnerabilities/219133 https://www.ibm.com/support/pages/node/6558796 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •