DeutschShown in its original language — a full translation is planned for a future version.
IBM InfoSphere Information Server: Mehrere Schwachstellen
view advisory published 2024-06-30
Ein entfernter Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen und vertrauliche Informationen offenzulegen.
01
describes (35)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-28794US | medium5.4 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int… | ||||
| CVE-2023-50964US | medium5.4 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int… | ||||
| CVE-2024-31898US | medium5.4 | — | ||
IBM InfoSphere Information Server 11.7 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references… | ||||
| CVE-2024-28797US | medium5.4 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable stored to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… | ||||
| CVE-2023-50953US | medium4.3 | — | ||
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be… | ||||
| CVE-2023-50952US | medium5.4 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system,… | ||||
| CVE-2024-35119US | medium5.3 | — | ||
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This inf… | ||||
| CVE-2024-31902US | high8.8 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a us… | ||||
| CVE-2024-28798US | medium6.1 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… | ||||
| CVE-2023-50954US | medium5.3 | — | ||
IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the system. IBM X-Force ID: 275776. | ||||
| CVE-2024-28795US | medium5.4 | — | ||
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int… | ||||
| CVE-2023-35022US | low3.3 | — | ||
IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254. | ||||
| CVE-2024-35195US | — | — | ||
Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all s… | ||||
| CVE-2024-34062US | — | — | ||
tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments (e.g. `--delim`, `--buf-size`, `--manpath`) are passed through python's `eval`, allow… | ||||
| CVE-2024-25026US | high7.5 | — | ||
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a speciall… | ||||
| CVE-2023-6237US | — | — | ||
Issue summary: Checking excessively long invalid RSA public keys may take
a long time.
Impact summary: Applications that use the function EVP_PKEY_public_check()
to check RSA publ… | ||||
| CVE-2024-22329US | — | — | ||
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a… | ||||
| CVE-2024-27268US | high7.5 | — | ||
IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could expl… | ||||
| CVE-2024-27270US | medium6.1 | — | ||
IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a sp… | ||||
| CVE-2023-5685US | — | — | ||
A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled… | ||||
showing 20 of 35
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2024-1488 - CSAF Versionself
- WID-SEC-2024-1488 - Portal Versionself
- IBM Security Bulletin 7158408 vom 2024-06-30external
- IBM Security Bulletin 7158425 vom 2024-06-30external
- IBM Security Bulletin 7158431 vom 2024-06-30external
- IBM Security Bulletin 7158437 vom 2024-06-30external
- IBM Security Bulletin 7158439 vom 2024-06-30external
- IBM Security Bulletin 7158440 vom 2024-06-30external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan