78 results (0.003 seconds)

CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2023-35890 – IBM WebSphere Application Server information disclosure

https://notcve.org/view.php?id=CVE-2023-35890

IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X-Force ID: 258637. IBM WebSphere Application Server v8.5 y v9.0 podrían proporcionar una seguridad más débil de lo esperado, causada por la codificación incorrecta en un archivo de configuración local. ID de IBM X-Force: 258637. • https://https://www.ibm.com/support/pages/node/7007857 https://www.ibm.com/support/pages/node/7007857 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •

CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2023-27554 – IBM WebSphere Application Server XML external entity injection

https://notcve.org/view.php?id=CVE-2023-27554

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249185. • https://exchange.xforce.ibmcloud.com/vulnerabilities/249185 https://www.ibm.com/support/pages/node/6989451 • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2023-24966 – IBM WebSphere Application Server cross-site scripting

https://notcve.org/view.php?id=CVE-2023-24966

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 246904. • https://exchange.xforce.ibmcloud.com/vulnerabilities/246904 https://www.ibm.com/support/pages/node/6986333 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.9EPSS: 0%CPEs: 11EXPL: 0

CVE-2022-38712

https://notcve.org/view.php?id=CVE-2022-38712

"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762." "IBM WebSphere Application Server 7.0, 8.0, 8.5 y 9.0 podrían permitir que un atacante intermediario realice suplantación de SOAPAction para ejecutar operaciones no deseadas o no autorizadas. ID de IBM X-Force: 234762". • https://www.ibm.com/support/pages/node/6829907 • CWE-290: Authentication Bypass by Spoofing •

CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0

CVE-2022-35282

https://notcve.org/view.php?id=CVE-2022-35282

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0 es vulnerable a un ataque de tipo server-side request forgery (SSRF). Al enviar una petición especialmente diseñada, un atacante con acceso a la red local podría aprovechar esta vulnerabilidad para obtener datos confidenciales • https://exchange.xforce.ibmcloud.com/vulnerabilities/230809 https://www.ibm.com/support/pages/node/6824179 • CWE-918: Server-Side Request Forgery (SSRF) •