DeutschShown in its original language — a full translation is planned for a future version.
IBM InfoSphere Information Server: Mehrere Schwachstellen
view advisory published 2023-07-16
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-2861US | high7.1OT elevated | — | ||
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a mal… | ||||
| CVE-2023-1108US | high7.5 | — | ||
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. | ||||
| CVE-2023-20860US | high7.5 | Exploit | ||
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern m… | ||||
| CVE-2023-20861US | medium6.5 | — | ||
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted… | ||||
| CVE-2023-1370US | high7.5 | — | ||
[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib.
When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array… | ||||
| CVE-2022-4492US | high7.5 | — | ||
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by defa… | ||||
| CVE-2022-1471US | critical9.8 | Exploit | ||
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code… | ||||
| CVE-2022-41854US | medium6.5 | — | ||
Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply co… | ||||
| CVE-2022-38752US | medium6.5 | — | ||
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content… | ||||
| CVE-2022-38751US | medium6.5 | — | ||
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content… | ||||
| CVE-2022-38750US | medium5.5 | — | ||
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content… | ||||
| CVE-2022-38749US | medium6.5 | — | ||
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content… | ||||
| CVE-2022-1259US | high7.5 | — | ||
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exis… | ||||
| CVE-2022-25857US | high7.5 | — | ||
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan