DeutschShown in its original language — a full translation is planned for a future version.
IBM InfoSphere Information Server: Mehrere Schwachstellen
view advisory published 2023-11-28
Ein entfernter Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Cross-Site-Scripting-Angriffe durchzuführen oder einen Denial of Service Zustand herbeizuführen.
01
describes (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-46174US | medium5.4 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… | ||||
| CVE-2023-43021US | medium5.3 | — | ||
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This infor… | ||||
| CVE-2023-42022US | medium5.4 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… | ||||
| CVE-2023-42019US | medium5.9OT elevated | — | ||
IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161.
| ||||
| CVE-2023-42009US | medium5.4 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int… | ||||
| CVE-2023-40699US | high7.5 | — | ||
IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161.
| ||||
| CVE-2023-43015US | medium5.4 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int… | ||||
| CVE-2023-38268US | high8.8 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a us… | ||||
| CVE-2023-43804US | high8.1 | Exploit | ||
urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the… | ||||
| CVE-2023-39410US | high7.5 | — | ||
When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.
This iss… | ||||
| CVE-2023-43642US | high7.5 | — | ||
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attack… | ||||
| CVE-2023-34462US | medium6.5 | — | ||
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate… | ||||
| CVE-2022-25883US | high7.5 | — | ||
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a ran… | ||||
| CVE-2021-23337US | high7.2 | Exploit | ||
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. | ||||
| CVE-2020-28500US | medium5.3 | — | ||
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. | ||||
| CVE-2020-8203US | high7.4 | Exploit | ||
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2023:7637 vom 2023-12-05external
- WID-SEC-W-2023-3025 - CSAF Versionself
- WID-SEC-2023-3025 - Portal Versionself
- IBM Security Advisory vom 2023-11-28external
- IBM Security Advisory vom 2023-11-28external
- IBM Security Advisory vom 2023-11-28external
- IBM Security Advisory vom 2023-11-28external
- IBM Security Advisory vom 2023-11-28external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan