DeutschShown in its original language — a full translation is planned for a future version.
IBM InfoSphere Information Server: Mehrere Schwachstellen
view advisory published 2022-10-16
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.
01
describes (29)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-40747US | critical9.1 | — | ||
"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability… | ||||
| CVE-2022-40235US | medium6.5 | — | ||
"IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run jobs due to improper input validation. IBM X-Force ID: 235725… | ||||
| CVE-2022-35717US | high7.8 | — | ||
"IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-"Forc… | ||||
| CVE-2022-35642US | medium5.4 | — | ||
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the in… | ||||
| CVE-2022-30615US | medium5.4 | — | ||
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the in… | ||||
| CVE-2022-30608US | high8.8 | — | ||
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a "… | ||||
| CVE-2022-22442US | medium6.5 | — | ||
"IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users with elevated privileges due to improper access controls. IBM X-… | ||||
| CVE-2022-36109US | medium6.3OT elevated | — | ||
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If… | ||||
| CVE-2022-31129US | high7.5 | — | ||
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Spe… | ||||
| CVE-2022-24769US | medium5.9 | — | ||
Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where contain… | ||||
| CVE-2022-23437US | medium6.5 | — | ||
There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an… | ||||
| CVE-2021-41091US | medium6.3 | Exploit | ||
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`)… | ||||
| CVE-2021-41089US | medium6.3 | — | ||
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into… | ||||
| CVE-2021-40690US | high7.5 | — | ||
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when crea… | ||||
| CVE-2021-36374US | medium5.5 | — | ||
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even f… | ||||
| CVE-2021-36373US | medium5.5 | — | ||
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs… | ||||
| CVE-2021-33813US | high7.5 | — | ||
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. | ||||
| CVE-2019-13116US | critical9.8 | — | ||
The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collectio… | ||||
| CVE-2017-15708US | critical9.8 | Exploit | ||
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1… | ||||
| CVE-2015-7501US | critical9.8OT critical | Exploit | ||
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fus… | ||||
showing 20 of 29
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2022-1738 - CSAF Versionself
- WID-SEC-2022-1738 - Portal Versionself
- IBM Security Bulletin: 6829311 vom 2022-10-16external
- IBM Security Bulletin: 6829325 vom 2022-10-16external
- IBM Security Bulletin: 6829327 vom 2022-10-16external
- IBM Security Bulletin: 6829335 vom 2022-10-16external
- IBM Security Bulletin: 6829339 vom 2022-10-16external
- IBM Security Bulletin: 6829349 vom 2022-10-16external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan