CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-3013
https://notcve.org/view.php?id=CVE-2016-3013
22 Feb 2017 — IBM WebSphere MQ 8.0 could allow an authenticated user to crash the MQ channel due to improper data conversion handling. IBM Reference #: 1998661. IBM WebSphere MQ 8.0 podría permitir a un usuario autenticado bloquear el canal MQ debido al manejo incorrecto de la conversión de datos. IBM Reference #: 1998661. • http://www.ibm.com/support/docview.wss?uid=swg21998661 • CWE-19: Data Processing Errors •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2016-3052
https://notcve.org/view.php?id=CVE-2016-3052
22 Feb 2017 — Under non-standard configurations, IBM WebSphere MQ might send password data in clear text over the network. This data could be intercepted using man in the middle techniques. Bajo configuraciones no estándar, WebSphere MQ de IBM, puede enviar datos de contraseña en texto sin cifrar por medio de la red. Estos datos podrían ser interceptados usando técnicas de tipo man in the middle. • http://www.ibm.com/support/docview.wss?uid=swg21998660 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2015-0176
https://notcve.org/view.php?id=CVE-2015-0176
27 Apr 2015 — Cross-site scripting (XSS) vulnerability in MQ XR WebSockets Listener in WMQ Telemetry in IBM WebSphere MQ 8.0 before 8.0.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URI that is included in an error response. Vulnerabilidad de XSS en MQ XR WebSockets Listener en WMQ Telemetry en IBM WebSphere MQ 8.0 anterior a 8.0.0.2 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de una URI manipulada que está incluida en una respuesta de err... • http://www-01.ibm.com/support/docview.wss?uid=swg21699549 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 19EXPL: 0CVE-2013-3028
https://notcve.org/view.php?id=CVE-2013-3028
02 Jul 2013 — Multiple buffer overflows in mqm programs in IBM WebSphere MQ 7.0.x before 7.0.1.11, 7.1.x before 7.1.0.3, and 7.5.x before 7.5.0.2 on non-Windows platforms allow local users to gain privileges via unspecified vectors. Múltiples desbordamientos de búfer en programas mqm en IBM WebSphere MQ v7.0.x anterior a v7.0.1.11, v7.1.x anterior a v7.1.0.3, y v7.5.x anterior a v7.5.0.2 sobre plataformas no-Windows permite a usuarios locales ganar privilegios mediante vectores desconocidos. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV43368 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 2CVE-2012-3294 – IBM Websphere MQ File Transfer Edition Web Gateway - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2012-3294
17 Aug 2012 — Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier, and WebSphere MQ - Managed File Transfer 7.5, allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add user accounts via the /wmqfteconsole/Filespaces URI, (2) modify permissions via the /wmqfteconsole/FileSpacePermisssions URI, or (3) add MQ Message Descriptor (MQMD) user accounts via the /wmqfteconsole/UploadUsers URI. ... • https://www.exploit-db.com/exploits/20477 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 7%CPEs: 7EXPL: 2CVE-2012-2206 – IBM Websphere MQ File Transfer Edition Web Gateway - Insufficient Access Control
https://notcve.org/view.php?id=CVE-2012-2206
17 Aug 2012 — The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI. El componente de puerta de enlace de Internet en IBM WebSphere MQ File Transfer Edition v7.0.4 y anteriores permite leer archivos de usuarios de su elección a usuarios remotos autenticados a través de vectores relacionados con un nomb... • https://www.exploit-db.com/exploits/20478 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2009-0900
https://notcve.org/view.php?id=CVE-2009-0900
30 Oct 2011 — Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local users to gain privileges via crafted SSL information in a Client Channel Definition Table (CCDT) file. Desbordamiento de búfer basado en memoria dinámica en el cliente de IBM WebSphere MQ v6.0 anterior a v6.0.2.7 y v7.0 anterior a v7.0.1.0 permite a usuarios locales conseguir privilegios a través de la información elaborada SSL en un fichero Client Channel Definition Table (CCDT). • http://www.ibm.com/support/docview.wss?uid=swg1IC59375 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2009-0905
https://notcve.org/view.php?id=CVE-2009-0905
30 Oct 2011 — IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow local users to gain privileges by leveraging combinations of group names with the same initial substring. IBM WebSphere MQ v6.0 anterior a v6.0.2.8 y v7.0 anterior a v7.0.1.0 no gestiona correctamente los nombres largos de grupo, lo que podría permitir a usuarios locales obtener privilegios mediante el aprovechamiento de las combinaciones de nombres de grupo con la misma subcadena inicial. • http://www.ibm.com/support/docview.wss?uid=swg1IZ37102 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2010-0780
https://notcve.org/view.php?id=CVE-2010-0780
29 Oct 2011 — IBM WebSphere MQ 7.x before 7.0.1.4 allows remote attackers to cause a denial of service (disk consumption) via multiple connection attempts to a stopped queue manager. IBM WebSphere MQ 7.x anteriores a 7.0.1.4 permite a atacantes remotos provocar una denegación de servicio (corrupción de disco) a través de intentos de conexión múltiples a un gestor de cola detenido. • http://www-01.ibm.com/support/docview.wss?uid=swg27014224 • CWE-399: Resource Management Errors •
CVSS: 5.9EPSS: 0%CPEs: 22EXPL: 0CVE-2011-1224
https://notcve.org/view.php?id=CVE-2011-1224
07 Jul 2011 — IBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 does not use the CRL Distribution Points (CDP) certificate extension, which might allow man-in-the-middle attackers to spoof an SSL partner via a revoked certificate for a (1) client, (2) queue manager, or (3) application. IBM WebSphere MQ v6.0 antes de v6.0.2.11 y antes de v7.0.1.5 7.0 no utiliza la extensión de certificado de los puntos de distribución (CDP) de los CRL (Listas de revocación de certificados), lo que podría permitir que a través de... • http://www-01.ibm.com/support/docview.wss?uid=swg27007069 • CWE-264: Permissions, Privileges, and Access Controls •