{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:apache:commons_collections:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "8569E279-6FF5-477C-A54A-874663C4B4E0",
                     versionEndIncluding: "3.2.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:commons_collections:4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9477582E-C8F2-4F8E-A61C-D6BDF3FD0517",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.",
      },
      {
         lang: "es",
         value: "Interfaces serialized-object en algunos productos Cisco Collaboration y Social Media; Endpoint Clients y Client Software; Network Application, Service y Acceleration; Network y Content Security Devices; Network Management y Provisioning; Routing y Switching - Enterprise y Service Provider; Unified Computing; Voice y Unified Communications Devices; Video, Streaming, TelePresence y Transcoding Devices; Wireless y Cisco Hosted Services permite atacantes remotos ejecutar comandos arbitrarios a través de un objeto Java serializado manipulado, relacionado con la librería Apache Commons Collections (ACC).",
      },
   ],
   id: "CVE-2015-6420",
   lastModified: "2025-03-25T17:15:41.720",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2015-12-15T05:59:07.823",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization",
      },
      {
         source: "psirt@cisco.com",
         url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/78872",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
      },
      {
         source: "psirt@cisco.com",
         url: "https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E",
      },
      {
         source: "psirt@cisco.com",
         url: "https://www.kb.cert.org/vuls/id/581311",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.tenable.com/security/research/tra-2017-14",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.tenable.com/security/research/tra-2017-23",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/78872",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://news.apache.org/foundation/entry/apache_commons_statement_to_widespread",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.kb.cert.org/vuls/id/576313",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.kb.cert.org/vuls/id/581311",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.tenable.com/security/research/tra-2017-14",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.tenable.com/security/research/tra-2017-23",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
      affected_products: {
         "@id": "https://www.variotdbs.pl/ref/affected_products",
      },
      configurations: {
         "@id": "https://www.variotdbs.pl/ref/configurations",
      },
      credits: {
         "@id": "https://www.variotdbs.pl/ref/credits",
      },
      cvss: {
         "@id": "https://www.variotdbs.pl/ref/cvss/",
      },
      description: {
         "@id": "https://www.variotdbs.pl/ref/description/",
      },
      exploit_availability: {
         "@id": "https://www.variotdbs.pl/ref/exploit_availability/",
      },
      external_ids: {
         "@id": "https://www.variotdbs.pl/ref/external_ids/",
      },
      iot: {
         "@id": "https://www.variotdbs.pl/ref/iot/",
      },
      iot_taxonomy: {
         "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/",
      },
      patch: {
         "@id": "https://www.variotdbs.pl/ref/patch/",
      },
      problemtype_data: {
         "@id": "https://www.variotdbs.pl/ref/problemtype_data/",
      },
      references: {
         "@id": "https://www.variotdbs.pl/ref/references/",
      },
      sources: {
         "@id": "https://www.variotdbs.pl/ref/sources/",
      },
      sources_release_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_release_date/",
      },
      sources_update_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_update_date/",
      },
      threat_type: {
         "@id": "https://www.variotdbs.pl/ref/threat_type/",
      },
      title: {
         "@id": "https://www.variotdbs.pl/ref/title/",
      },
      type: {
         "@id": "https://www.variotdbs.pl/ref/type/",
      },
   },
   "@id": "https://www.variotdbs.pl/vuln/VAR-201512-0395",
   affected_products: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            model: "commons collections",
            scope: "eq",
            trust: 2.2,
            vendor: "apache",
            version: "4.0",
         },
         {
            model: "commons collections",
            scope: "lte",
            trust: 1.8,
            vendor: "apache",
            version: "3.2.1",
         },
         {
            model: "capssuite",
            scope: null,
            trust: 1.6,
            vendor: "nec",
            version: null,
         },
         {
            model: "infoframe relational store",
            scope: null,
            trust: 1.6,
            vendor: "nec",
            version: null,
         },
         {
            model: "systemdirector enterprise",
            scope: null,
            trust: 1.6,
            vendor: "nec",
            version: null,
         },
         {
            model: "webotx",
            scope: null,
            trust: 1.6,
            vendor: "nec",
            version: null,
         },
         {
            model: "commons collections",
            scope: "eq",
            trust: 1.2,
            vendor: "apache",
            version: "3.2.1",
         },
         {
            model: null,
            scope: null,
            trust: 0.8,
            vendor: "tp link",
            version: null,
         },
         {
            model: "commons collections",
            scope: "lte",
            trust: 0.8,
            vendor: "apache",
            version: "4.0",
         },
         {
            model: "eap controller",
            scope: "eq",
            trust: 0.3,
            vendor: "tp link",
            version: "2.5.3",
         },
         {
            model: "eap controller",
            scope: "eq",
            trust: 0.3,
            vendor: "tp link",
            version: "2.4.8",
         },
         {
            model: "insight control",
            scope: "eq",
            trust: 0.3,
            vendor: "hp",
            version: "7.5.1",
         },
         {
            model: "insight control",
            scope: "eq",
            trust: 0.3,
            vendor: "hp",
            version: "7.5",
         },
         {
            model: "insight control",
            scope: "eq",
            trust: 0.3,
            vendor: "hp",
            version: "7.4",
         },
         {
            model: "insight control",
            scope: "eq",
            trust: 0.3,
            vendor: "hp",
            version: "7.3",
         },
         {
            model: "insight control",
            scope: "eq",
            trust: 0.3,
            vendor: "hp",
            version: "7.2",
         },
         {
            model: "webex meetings server 2.5mr2",
            scope: null,
            trust: 0.3,
            vendor: "cisco",
            version: null,
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "2.5.99.2",
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "2.5.0.997",
         },
         {
            model: "webex meetings server mr1",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "2.5",
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "2.5",
         },
         {
            model: "webex meetings server 2.0mr2",
            scope: null,
            trust: 0.3,
            vendor: "cisco",
            version: null,
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "2.0",
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "1.5.1.6",
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "1.5.1.131",
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "1.5(.1.6)",
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "1.5(.1.131)",
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "1.5",
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "1.1",
         },
         {
            model: "webex meetings server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "1.0",
         },
         {
            model: "visual quality experience tools server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "visual quality experience server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "virtue machine placement tool",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "videoscape conductor",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "unified sip proxy",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "unified services delivery platform",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "unified intelligent contact management enterprise",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "unified intelligence center",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "unified contact center enterprise",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "unified communications upgrade readiness assessment",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "unified communications manager session management edition",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "unified communications manager",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "telepresence exchange system",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "socialminer",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "smart net total care",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "si component of partner supporting service",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "show and share",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "serial number assessment service",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "security manager",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "secure access control system",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "registered envelope service",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "prime service catalog virtual appliance",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "prime provisioning for sps",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "prime provisioning",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "prime performance manager",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "prime optical for sps",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "prime lan management solution",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "prime home",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "prime collaboration provisioning",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "prime access registrar appliance",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "prime access registrar",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "partner supporting service",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "1.0",
         },
         {
            model: "network admission control",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "nac server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "nac manager",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "nac guest server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "nac agent",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "meetingplace",
            scope: null,
            trust: 0.3,
            vendor: "cisco",
            version: null,
         },
         {
            model: "mediasense",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "media experience engines",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "management heartbeat server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "ip interoperability and collaboration system",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "intracer",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "insight reporter",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "im and presence service",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "hosted collaboration mediation fulfillment",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "digital media manager",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "digital life rms",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "1.8.1.1",
         },
         {
            model: "dcaf ucs collector",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "data center analytics framework",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "configuration professional",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "computer telephony integration object server",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "communication sizing tool",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "collaboration sizing tool",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "cloupia unified infrastructure controller",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "cloud email security",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "clean access manager",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "business video services automation software",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "broadband access center telco wireless",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "3.8.1",
         },
         {
            model: "asa cx and cisco prime security manager",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "access registrar appliance",
            scope: "eq",
            trust: 0.3,
            vendor: "cisco",
            version: "0",
         },
         {
            model: "jenkins",
            scope: "eq",
            trust: 0.3,
            vendor: "jenkins ci",
            version: "0",
         },
         {
            model: "commons collections",
            scope: "eq",
            trust: 0.3,
            vendor: "apache",
            version: "3.0",
         },
      ],
      sources: [
         {
            db: "CERT/CC",
            id: "VU#581311",
         },
         {
            db: "BID",
            id: "78872",
         },
         {
            db: "BID",
            id: "77521",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-006448",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-005930",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-420",
         },
         {
            db: "NVD",
            id: "CVE-2015-6420",
         },
      ],
   },
   configurations: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/configurations#",
         children: {
            "@container": "@list",
         },
         cpe_match: {
            "@container": "@list",
         },
         data: {
            "@container": "@list",
         },
         nodes: {
            "@container": "@list",
         },
      },
      data: [
         {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:apache:commons_collections:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndIncluding: "3.2.1",
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:apache:commons_collections:4.0:*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
      ],
      sources: [
         {
            db: "NVD",
            id: "CVE-2015-6420",
         },
      ],
   },
   credits: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/credits#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "foxglovesecurity",
      sources: [
         {
            db: "BID",
            id: "77521",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-421",
         },
      ],
      trust: 0.9,
   },
   cve: "CVE-2015-6420",
   cvss: {
      "@context": {
         cvssV2: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2",
         },
         cvssV3: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/",
         },
         severity: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/cvss/severity#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/severity",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            cvssV2: [
               {
                  acInsufInfo: false,
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "NVD",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  impactScore: 6.4,
                  integrityImpact: "PARTIAL",
                  obtainAllPrivilege: false,
                  obtainOtherPrivilege: false,
                  obtainUserPrivilege: false,
                  severity: "HIGH",
                  trust: 1,
                  userInteractionRequired: false,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               {
                  acInsufInfo: null,
                  accessComplexity: "Low",
                  accessVector: "Network",
                  authentication: "None",
                  author: "NVD",
                  availabilityImpact: "Partial",
                  baseScore: 7.5,
                  confidentialityImpact: "Partial",
                  exploitabilityScore: null,
                  id: "CVE-2015-6420",
                  impactScore: null,
                  integrityImpact: "Partial",
                  obtainAllPrivilege: null,
                  obtainOtherPrivilege: null,
                  obtainUserPrivilege: null,
                  severity: "High",
                  trust: 0.9,
                  userInteractionRequired: null,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               {
                  acInsufInfo: null,
                  accessComplexity: "Low",
                  accessVector: "Network",
                  authentication: "None",
                  author: "IPA",
                  availabilityImpact: "Partial",
                  baseScore: 7.5,
                  confidentialityImpact: "Partial",
                  exploitabilityScore: null,
                  id: "JVNDB-2015-005930",
                  impactScore: null,
                  integrityImpact: "Partial",
                  obtainAllPrivilege: null,
                  obtainOtherPrivilege: null,
                  obtainUserPrivilege: null,
                  severity: "High",
                  trust: 0.8,
                  userInteractionRequired: null,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
            ],
            cvssV3: [],
            severity: [
               {
                  author: "NVD",
                  id: "CVE-2015-6420",
                  trust: 1.8,
                  value: "HIGH",
               },
               {
                  author: "IPA",
                  id: "JVNDB-2015-005930",
                  trust: 0.8,
                  value: "High",
               },
               {
                  author: "CNNVD",
                  id: "CNNVD-201512-420",
                  trust: 0.6,
                  value: "CRITICAL",
               },
               {
                  author: "VULMON",
                  id: "CVE-2015-6420",
                  trust: 0.1,
                  value: "HIGH",
               },
            ],
         },
      ],
      sources: [
         {
            db: "VULMON",
            id: "CVE-2015-6420",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-006448",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-005930",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-420",
         },
         {
            db: "NVD",
            id: "CVE-2015-6420",
         },
      ],
   },
   description: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/description#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. EAP Controller for Linux lacks user authentication for RMI service commands, as well as utilizes an outdated vulnerable version of Apache commons-collections, which may allow an attacker to implement deserialization attacks and control the EAP Controller server. plural Cisco The serialized object interface of the product contains an arbitrary command execution vulnerability. http://cwe.mitre.org/data/definitions/502.htmlSkillfully crafted serialized by a third party Java An arbitrary command may be executed through the object. Apache Commons Collections (ACC) The library deserialization process is vulnerable. Java Application ACC When using the library directly or within the range accessible by specifying the class path ACC If a library is installed, arbitrary code may be executed. Apache Commons Collections (ACC) Library http://commons.apache.org/proper/commons-collections/ Deserialize untrusted data (CWE-502) 2015 Year 1 Held on the moon AppSec California 2015 In Gabriel Lawrence Mr. and Chris Frohoff He talked about a vulnerability that could deserialize untrusted data and showed that it could execute arbitrary code. Any use of the serialization function that is not appropriate Java Application or Java Libraries are affected by this vulnerability. Deserialize untrusted data (CWE-502) http://cwe.mitre.org/data/definitions/502.html Gabriel Lawrence Mr. and Chris Frohoff Mr. Lecture http://frohoff.github.io/appseccali-marshalling-pickles/ 2015 Year 11 A month Foxglove Security of Stephen Breen Mr. this problem Apache Commons Collections (ACC) Exist in the library, especially for deserializing untrusted data InvokerTransformer It was pointed out that arbitrary code could be executed when using classes. ACC Software that uses the library, WebSphere , Jenkins , WebLogic , OpenNMS Etc. are also affected. Foxglove Security of Stephen Breen Mr (What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.) http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ Jenkins https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11 WebLogic http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html?elq_mid=31793&sh=&cmid=WWSU12091612MPP001C179 ACC Library version 3.2.1 , 4.0 Both are affected by this vulnerability. version 3.2.1 , 4.0 https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Apache Software Fondation Has posted an official view of the vulnerability on its blog. Here you can find advice on countermeasures and links to related information. In addition, entries related to this vulnerability (COLLECTIONS-580) Is built on a bug management system. Official view https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread Entries related to this vulnerability (COLLECTIONS-580) https://issues.apache.org/jira/browse/COLLECTIONS-580 ACC other than, Groovy And Spring The same problem is being investigated for these issues. Lawrence Mr. and Frohoff In his presentation material, Java not only Python And Ruby It is stated that the same problem exists in applications and libraries written in the above. Regardless of the programming language or library used, it is important to fully consider the data serialization capabilities from the software design stage.Apache Commons Collections I'm using a library Java Application or Java Library is optional Java It may be possible to execute code. Also, ACC Even if the library is not used directly, it can be accessed by specifying the class path. ACC If the library exists, any Java It may be possible to execute code. Oracle WebLogic is an application server based on Java (J2EE) architecture of Oracle Corporation of the United States. Red Hat JBOSS is an open source J2EE-based application server from Red Hat. CloudBees Jenkins CI (formerly known as Hudson Labs) is a set of Java-based continuous integration tools developed by CloudBees. OpenNMS is a set of enterprise-level, Java / XML-based distributed network and system monitoring and management platform from the American OpenNMS company. It can extend or add Java collections framework. \nA remote command execution vulnerability exists in Java's deserialization process. A remote attacker can exploit this vulnerability by constructing an automatically executed code call chain to attach malicious code to user input and execute arbitrary Java functions or bytecode. The following products and versions are affected: JBoss Enterprise Application Platform 6.4.4, 5.2.0, 4.3.0_CP10, AS (Wildly) 6 and earlier, A-MQ 6.2.0, Fuse 6.2.0, SOA Platform (SOA-P) 5.3.1, Data Grid (JDG) 6.5.0, BRMS (BRMS) 6.1.0, BPMS (BPMS) 6.1.0, Data Virtualization (JDV) 6.1.0, Fuse Service Works (FSW) version 6.0.0, Enterprise Web Server (EWS) version 2.1, version 3.0, Jenkins version 1.555, WebSphere, WebLogic, OpenNMS. Apache Commons Collections（ACC）是美国阿帕奇（Apache）软件基金会的一个Apache Commons项目的Commons Proper（可重复利用Java组件库）中的组件，它可以扩展或增加Java集合框架. \n\n多款Cisco产品的ACC库中使用的Java反序列化过程中存在安全漏洞。远程攻击者可通过提交特制的输入利用该漏洞执行任意代码。以下产品及版本受到影响：Cisco Digital Life RMS 1.8.1.1版本，Broadband Access Center Telco Wireless 3.8.1版本；SocialMiner，WebEx Meetings Server 1.x版本，2.x版本；NAC Agent for Windows；InTracer，Network Admission Control (NAC)，Visual Quality Experience Server，Visual Quality Experience Tools Server；ASA CX and Cisco Prime Security Manager，Clean Access Manager，NAC Appliance (Clean Access Server)，NAC Guest Server，NAC Server，Secure Access Control System (ACS)；Access Registrar Appliance，Cloupia Unified Infrastructure Controller，Configuration Professional，Digital Media Manager，Insight Reporter，Prime Access Registrar Appliance，Prime Access Registrar，Prime Collaboration Provisioning，Prime Home，Prime LAN Management Solution (LMS - Solaris)，Prime Optical for SPs，Prime Performance Manager，Prime Provisioning for SPs，Prime Provisioning，Prime Service Catalog Virtual Appliance，Security Manager，Data Center Analytics Framework (DCAF)；Broadband Access Center Telco Wireless；Computer Telephony Integration Object Server (CTIOS)，Hosted Collaboration Mediation Fulfillment，IM and Presence Service (CUPS)，IP Interoperability and Collaboration System (IPICS)，Management Heartbeat Server，MediaSense，MeetingPlace，Unified Communications Manager (UCM)，Unified Communications Manager Session Management Edition (SME)，Unified Contact Center Enterprise，Unified Intelligence Center，Unified Intelligent Contact Management Enterprise，Unified Sip Proxy；Media Experience Engines (MXE)，Show and Share，TelePresence Exchange System (CTX)，Videoscape Conductor；Business Video Services Automation Software (BV)，Cloud Email Security，Registered Envelope Service (CRES)，Unified Services Delivery Platform (CUSDP)，Communication/Collaboration Sizing Tool, Virtue Machine Placement Tool，Unified Communications Upgrade Readiness Assessment，DCAF UCS Collector，Network Change and Configuration Management，Partner Supporting Service (PSS) 1.x版本，SI component of Partner Supporting Service，Serial Number Assessment Service (SNAS)，Smart Net Total Care (SNTC). -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nCisco Security Advisory: Vulnerability in Java Deserialization Affecting Cisco Products\n\nAdvisory ID: cisco-sa-20151209-java-deserialization\n\nRevision 1.0\n\nFor Public Release: 2015 December 9 16:00  GMT\n+---------------------------------------------------------------------\n\nSummary\n=======\n\nA vulnerability in the Java deserialization used by the Apache Commons Collections (ACC) library could allow an unauthenticated, remote attacker to execute arbitrary code. The report contains detailed proof-of-concept code for a number of applications, including WebSphere Application Server, JBoss, Jenkins, OpenNMS, and WebLogic. A wide range of potential impacts includes allowing the attacker to obtain sensitive information. \n\nObject serialization is a technique that many programming languages use to convert an object into a sequence of bits for transfer purposes. Deserialization is a technique that reassembles those bits back to an object. \n\nMany applications accept serialized objects from the network without performing input validation checks before deserializing it. \n\nAdditional details about the vulnerability are available at the following links:\n\nOfficial Vulnerability Note from CERT:\nhttp://www.kb.cert.org/vuls/id/576313\n\nFoxglove Security:\nhttp://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/\n\nApache Commons Statement:\nhttps://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread\n\nOracle Security Alert:\nhttps://blogs.oracle.com/security/entry/security_alert_cve_2015_4852\n\nCisco will release software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability. \n\nThis advisory is available at the following link:\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization\n\n-----BEGIN PGP SIGNATURE-----\nComment: GPGTools - http://gpgtools.org\n\niQIcBAEBCAAGBQJWaE9BAAoJEIpI1I6i1Mx31a0QALya6VDmcGiyx3AlCzsKGISc\n3NJP4PPjVFGjHQmB/+bXn1zXLZ63JgbOZuG9pLxhmJpPMxQI8jeXEHqzVmrA9cOj\nu/QRGkITxQaRS50cwFJXPDOVWWCTcHLhuk83Ofih8vhC8UPBy1FGMBl5rpVLDkG9\nue8yX5ACEQ078F78dpcnJmbv1Hxu021wI+nM3pn7C/aOrJ1wSNop8KkFZ+VHzbKY\naeuMFqhal+ePx+JoIC4JMrTll/BLxjI17tKrzXas6D4zKNGSO0WxnEFjDWuPlc89\n2y3DnaVc0eeAVPy3ODN6wJzuro4w69z1GrvXPkBfVe9WNKD1lMGRUPMRwnb/zjxu\nDT8Ms4LDaVCLDZ01ox3BpuZIDBP1q2Xk6ToObeHUNMSDM9IuMeVOz9BtxJxO8Yp/\nYfVaoqkM6Vrf5oXKUvWow0r19+ODp18JUnc8qT7Cj0b9PwtlOUqpsNE+cAzPyZh7\nUBYLPm2AZypOgw4ryUf66p3l+NGLvLdA+A1u0m+YfXSrsuEFCosUeppmZMvgzEME\n7TDSbOlt6yj9W/U3ioYbhLWk1D2whTyDybXz4MLaPTPxfxozyePOcthU7R/PVGrU\nM0Do8nugnDXE0rYVRooF3+A/6ahoKUb9QR00O4xN4A94lfXqgc6t+180S4vavgxS\ng9ZP7zYVhaDCRufDoNVI\n=nsL1\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05376917\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c05376917\nVersion: 1\n\nHPSBMU03685 rev.1 - HPE Insight Control server provisioning (ICsp), Multiple\nRemote Vulnerabilities\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2017-01-18\nLast Updated: 2017-01-18\n\nPotential Security Impact: Remote: Arbitrary Code Execution, Arbitrary\nCommand Execution, Denial of Service (DoS), Disclosure of Sensitive\nInformation, Unauthorized Access to Files\n\nSource: Hewlett Packard Enterprise, Product Security Response Team\n\nVULNERABILITY SUMMARY\nMultiple potential security vulnerabilities have been identified in HPE\nInsight Control server provisioning (ICsp) software. The vulnerabilities\ncould be exploited remotely resulting in Denial of Service (DoS), arbitrary\ncode execution, arbitrary command execution, unauthorized access to files or\ndisclosure of sensitive information. \n\nReferences:\n\n  - CVE-2015-6420 - Cisco routing and switching, execution of code\n  - CVE-2016-0702 - OpenSSL, disclosure of information, \"CacheBleed\"\n  - CVE-2016-0705 - OpenSSL, denial of service (DoS)\n  - CVE-2016-0797 - OpenSSL, denial of service (DoS)\n  - CVE-2016-0799 - OpenSSL, denial of service (DoS)\n  - CVE-2016-2842 - OpenSSL, denial of service (DoS)\n  - CVE-2015-7547 - glibc, denial of service (DoS)\n  - CVE-2014-0050 -  Apache Commons FileUpload, denial of service (DoS) \n  - CVE-2014-4877 - wget, execution of arbitrary code\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. \n\n  - HP Insight Control server provisioning all versions prior to 7.6\n\nBACKGROUND\n\n  CVSS Base Metrics\n  =================\n  Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector\n\n    CVE-2014-0050\n      7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2014-4877\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)\n\n    CVE-2015-6420\n      7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n      7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)\n\n    CVE-2015-7547\n      5.6 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L\n      6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)\n\n    CVE-2016-0702\n      2.9 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\n      1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N)\n\n    CVE-2016-0705\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)\n\n    CVE-2016-0797\n      5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n      5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)\n\n    CVE-2016-0799\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)\n\n    CVE-2016-2842\n      9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n      10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)\n\n    Information on CVSS is documented in\n    HPE Customer Notice HPSN-2008-002 here:\n\nhttps://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499\n\nRESOLUTION\n\nHPE has made the following software updates available to resolve the\nvulnerabilities for the impacted versions of HPE Insight Control server\nprovisioning (ICsp). Please download the latest version of Insight Control\nserver provisioning (ICsp)-7.6 from the following location: \n\n  *\n<https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb\nr=IMDVD>\n\nHISTORY\nVersion:1 (rev.1) - 18 January 2017 Initial release\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer's patch management\npolicy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HPE Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hpe.com. \n\nReport: To report a potential security vulnerability for any HPE supported\nproduct:\n  Web form: https://www.hpe.com/info/report-security-vulnerability\n  Email: security-alert@hpe.com\n\nSubscribe: To initiate a subscription to receive future HPE Security Bulletin\nalerts via Email: http://www.hpe.com/support/Subscriber_Choice\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here: http://www.hpe.com/support/Security_Bulletin_Archive\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HPE General Software\nHF = HPE Hardware and Firmware\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPV = ProCurve\nST = Storage Software\nUX = HP-UX\n\nCopyright 2016 Hewlett Packard Enterprise\n\nHewlett Packard Enterprise shall not be liable for technical or editorial\nerrors or omissions contained herein. The information provided is provided\n\"as is\" without warranty of any kind. To the extent permitted by law, neither\nHP or its affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. Hewlett\nPackard Enterprise and the names of Hewlett Packard Enterprise products\nreferenced herein are trademarks of Hewlett Packard Enterprise in the United\nStates and other countries. Other product and company names mentioned herein\nmay be trademarks of their respective owners",
      sources: [
         {
            db: "NVD",
            id: "CVE-2015-6420",
         },
         {
            db: "CERT/CC",
            id: "VU#581311",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-006448",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-005930",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-421",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201511-241",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-420",
         },
         {
            db: "BID",
            id: "77521",
         },
         {
            db: "VULMON",
            id: "CVE-2015-6420",
         },
         {
            db: "PACKETSTORM",
            id: "134752",
         },
         {
            db: "PACKETSTORM",
            id: "140605",
         },
      ],
      trust: 5.22,
   },
   external_ids: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            db: "NVD",
            id: "CVE-2015-6420",
            trust: 2.9,
         },
         {
            db: "CERT/CC",
            id: "VU#576313",
            trust: 2.8,
         },
         {
            db: "CERT/CC",
            id: "VU#581311",
            trust: 2.7,
         },
         {
            db: "BID",
            id: "78872",
            trust: 1.9,
         },
         {
            db: "JVN",
            id: "JVNVU94276522",
            trust: 1.6,
         },
         {
            db: "TENABLE",
            id: "TRA-2017-14",
            trust: 1.6,
         },
         {
            db: "TENABLE",
            id: "TRA-2017-23",
            trust: 1.6,
         },
         {
            db: "BID",
            id: "77521",
            trust: 0.9,
         },
         {
            db: "JVN",
            id: "JVNVU96340370",
            trust: 0.8,
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-006448",
            trust: 0.8,
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-005930",
            trust: 0.8,
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-421",
            trust: 0.6,
         },
         {
            db: "OPENWALL",
            id: "OSS-SECURITY/2015/11/11/3",
            trust: 0.6,
         },
         {
            db: "CNNVD",
            id: "CNNVD-201511-241",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2019.3165",
            trust: 0.6,
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-420",
            trust: 0.6,
         },
         {
            db: "VULMON",
            id: "CVE-2015-6420",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "134752",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "140605",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "CERT/CC",
            id: "VU#581311",
         },
         {
            db: "VULMON",
            id: "CVE-2015-6420",
         },
         {
            db: "BID",
            id: "78872",
         },
         {
            db: "BID",
            id: "77521",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-006448",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-005930",
         },
         {
            db: "PACKETSTORM",
            id: "134752",
         },
         {
            db: "PACKETSTORM",
            id: "140605",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-421",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201511-241",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-420",
         },
         {
            db: "NVD",
            id: "CVE-2015-6420",
         },
      ],
   },
   id: "VAR-201512-0395",
   iot: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/iot#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: true,
      sources: [
         {
            db: "VARIoT devices database",
            id: null,
         },
      ],
      trust: 0.4424944225,
   },
   last_update_date: "2024-04-19T19:46:59.905000Z",
   patch: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/patch#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            title: "cisco-sa-20151209-java-deserialization",
            trust: 1.6,
            url: "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20151209-java-deserialization",
         },
         {
            title: "NV16-002",
            trust: 1.6,
            url: "http://jpn.nec.com/security-info/secinfo/nv16-002.html",
         },
         {
            title: "Apache Commons statement to widespread Java object de-serialisation vulnerability",
            trust: 1.6,
            url: "https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread",
         },
         {
            title: "Top Page",
            trust: 0.8,
            url: "http://commons.apache.org/proper/commons-collections/",
         },
         {
            title: "COLLECTIONS-580: Arbitrary remote code execution with InvokerTransformer",
            trust: 0.8,
            url: "https://issues.apache.org/jira/browse/collections-580",
         },
         {
            title: "HS16-010",
            trust: 0.8,
            url: "http://www.hitachi.co.jp/prod/comp/soft1/global/security/info/vuls/hs16-010/index.html",
         },
         {
            title: "1970575",
            trust: 0.8,
            url: "http://www-01.ibm.com/support/docview.wss?uid=swg21970575",
         },
         {
            title: "Jenkins Security Advisory 2015-11-11",
            trust: 0.8,
            url: "https://wiki.jenkins-ci.org/display/security/jenkins+security+advisory+2015-11-11",
         },
         {
            title: "Secure Coding Guidelines for Java SE",
            trust: 0.8,
            url: "http://www.oracle.com/technetwork/java/seccodeguide-139067.html#8",
         },
         {
            title: "Oracle Security Alert for CVE-2015-4852",
            trust: 0.8,
            url: "http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html",
         },
         {
            title: "HS16-010",
            trust: 0.8,
            url: "http://www.hitachi.co.jp/prod/comp/soft1/security/info/vuls/hs16-010/index.html",
         },
         {
            title: "日立ディスクアレイシステムにおけるSVP セキュリティホール",
            trust: 0.8,
            url: "http://www.hitachi.co.jp/products/it/storage-solutions/techsupport/sec_info/sec_acc20160328.html",
         },
         {
            title: "Multiple Cisco product Apache Commons Collections Fixes for library arbitrary code execution vulnerabilities",
            trust: 0.6,
            url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=90854",
         },
         {
            title: "Debian CVElist Bug Report Logs: logback: CVE-2017-5929: serialization vulnerability affecting the SocketServer and ServerSocketReceiver components",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=a2fcdf172bb6bcdc6b94a705615d0184",
         },
         {
            title: "Cisco: Vulnerability in Java Deserialization Affecting Cisco Products",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20151209-java-deserialization",
         },
         {
            title: "IBM: Security Bulletin: Multiple vulnerabilities in IBM WebSphere eXtreme Scale Liberty Deployment.",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=79b8774da31f52ed0fc7f5e9561104e9",
         },
         {
            title: "IBM: Security Bulletin: Multiple vulnerability issues affect IBM Spectrum Symphony 7.3.1",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=c47c09015d1429df4a71453000607351",
         },
         {
            title: "IBM: IBM Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple security vulnerabilities",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=8580d3cd770371e2ef0f68ca624b80b0",
         },
         {
            title: "Oracle: Oracle Critical Patch Update Advisory - July 2018",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=5f8c525f1408011628af1792207b2099",
         },
         {
            title: "fake-vulnerabilities-java-maven",
            trust: 0.1,
            url: "https://github.com/xthk/fake-vulnerabilities-java-maven ",
         },
         {
            title: "",
            trust: 0.1,
            url: "https://github.com/andy-r2c/mavenjavatest ",
         },
         {
            title: "",
            trust: 0.1,
            url: "https://github.com/learngove/examplejavamaven ",
         },
         {
            title: "",
            trust: 0.1,
            url: "https://github.com/cheatahh/jvm-reverseshell ",
         },
         {
            title: "apkRepair",
            trust: 0.1,
            url: "https://github.com/qiqiapink/apkrepair ",
         },
      ],
      sources: [
         {
            db: "VULMON",
            id: "CVE-2015-6420",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-006448",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-005930",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-420",
         },
      ],
   },
   problemtype_data: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            problemtype: "CWE-Other",
            trust: 1.6,
         },
         {
            problemtype: "CWE-502",
            trust: 1,
         },
      ],
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2015-006448",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-005930",
         },
         {
            db: "NVD",
            id: "CVE-2015-6420",
         },
      ],
   },
   references: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/references#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            trust: 2.8,
            url: "https://www.kb.cert.org/vuls/id/576313",
         },
         {
            trust: 2.6,
            url: "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20151209-java-deserialization",
         },
         {
            trust: 2.1,
            url: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
         },
         {
            trust: 1.9,
            url: "https://www.kb.cert.org/vuls/id/581311",
         },
         {
            trust: 1.6,
            url: "http://jvn.jp/vu/jvnvu94276522/index.html",
         },
         {
            trust: 1.6,
            url: "http://www.securityfocus.com/bid/78872",
         },
         {
            trust: 1.6,
            url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05376917",
         },
         {
            trust: 1.6,
            url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
         },
         {
            trust: 1.6,
            url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05390722",
         },
         {
            trust: 1.6,
            url: "https://www.tenable.com/security/research/tra-2017-14",
         },
         {
            trust: 1.6,
            url: "https://www.tenable.com/security/research/tra-2017-23",
         },
         {
            trust: 1.4,
            url: "http://frohoff.github.io/appseccali-marshalling-pickles/",
         },
         {
            trust: 1,
            url: "https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread",
         },
         {
            trust: 1,
            url: "https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3ccommits.samza.apache.org%3e",
         },
         {
            trust: 0.9,
            url: "https://issues.apache.org/jira/browse/collections-580",
         },
         {
            trust: 0.8,
            url: "https://www.tp-link.com/en/download/eap220.html#controller_software",
         },
         {
            trust: 0.8,
            url: "https://docs.oracle.com/javase/8/docs/technotes/guides/rmi/rmi_security_recommendations.html",
         },
         {
            trust: 0.8,
            url: "http://cwe.mitre.org/data/definitions/306.html",
         },
         {
            trust: 0.8,
            url: "http://cwe.mitre.org/data/definitions/502.html",
         },
         {
            trust: 0.8,
            url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6420",
         },
         {
            trust: 0.8,
            url: "https://jvn.jp/vu/jvnvu96340370/index.html",
         },
         {
            trust: 0.8,
            url: "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6420",
         },
         {
            trust: 0.6,
            url: "http://www.securityfocus.com/bid/77521",
         },
         {
            trust: 0.6,
            url: "http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html?elq_mid=31793&sh=&cmid=wwsu12091612mpp001c179",
         },
         {
            trust: 0.6,
            url: "https://wiki.jenkins-ci.org/display/security/jenkins+security+advisory+2015-11-11",
         },
         {
            trust: 0.6,
            url: "http://www.openwall.com/lists/oss-security/2015/11/11/3",
         },
         {
            trust: 0.6,
            url: "http://www.infoq.com/news/2015/11/commons-exploit",
         },
         {
            trust: 0.6,
            url: "https://tersesystems.com/2015/11/08/closing-the-open-door-of-java-object-serialization/",
         },
         {
            trust: 0.6,
            url: "http://mail-archives.apache.org/mod_mbox/commons-dev/201511.mbox/%3c20151106222553.00002c57.ecki@zusammenkunft.net%3e",
         },
         {
            trust: 0.6,
            url: "http://www.slideshare.net/frohoff1/appseccali-2015-marshalling-pickles",
         },
         {
            trust: 0.6,
            url: "https://www.youtube.com/watch?v=vviy3o-euvq",
         },
         {
            trust: 0.6,
            url: "https://commons.apache.org/proper/commons-collections/",
         },
         {
            trust: 0.6,
            url: "https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageid=27492407",
         },
         {
            trust: 0.6,
            url: "http://www.oracle.com/technetwork/java/seccodeguide-139067.html#8",
         },
         {
            trust: 0.6,
            url: "https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21@%3ccommits.samza.apache.org%3e",
         },
         {
            trust: 0.6,
            url: "https://www.ibm.com/support/docview.wss?uid=ibm10967469",
         },
         {
            trust: 0.6,
            url: "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-websphere-extreme-scale-liberty-deployment/",
         },
         {
            trust: 0.6,
            url: "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-identified-in-ibm-storediq/",
         },
         {
            trust: 0.6,
            url: "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-workspace-is-affected-by-security-vulnerabilities-2/",
         },
         {
            trust: 0.6,
            url: "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerability-issues-affect-ibm-spectrum-symphony-7-3-1/",
         },
         {
            trust: 0.6,
            url: "http://www.ibm.com/support/docview.wss?uid=ibm10958165",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2019.3165/",
         },
         {
            trust: 0.4,
            url: "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05376917",
         },
         {
            trust: 0.3,
            url: "http://www.cisco.com/",
         },
         {
            trust: 0.3,
            url: "http://seclists.org/oss-sec/2015/q4/237",
         },
         {
            trust: 0.3,
            url: "http://seclists.org/oss-sec/2015/q4/241",
         },
         {
            trust: 0.1,
            url: "https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852",
         },
         {
            trust: 0.1,
            url: "http://gpgtools.org",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2016-0797",
         },
         {
            trust: 0.1,
            url: "http://www.hpe.com/support/security_bulletin_archive",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2014-4877",
         },
         {
            trust: 0.1,
            url: "https://www.hpe.com/info/report-security-vulnerability",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2015-7547",
         },
         {
            trust: 0.1,
            url: "http://www.hpe.com/support/subscriber_choice",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2016-0702",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2016-2842",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2015-6420",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2016-0705",
         },
         {
            trust: 0.1,
            url: "https://h20392.www2.hpe.com/portal/swdepot/displayproductinfo.do?productnumb",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2014-0050",
         },
         {
            trust: 0.1,
            url: "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c01345499",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2016-0799",
         },
      ],
      sources: [
         {
            db: "CERT/CC",
            id: "VU#581311",
         },
         {
            db: "BID",
            id: "78872",
         },
         {
            db: "BID",
            id: "77521",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-006448",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-005930",
         },
         {
            db: "PACKETSTORM",
            id: "134752",
         },
         {
            db: "PACKETSTORM",
            id: "140605",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-421",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201511-241",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-420",
         },
         {
            db: "NVD",
            id: "CVE-2015-6420",
         },
      ],
   },
   sources: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            db: "CERT/CC",
            id: "VU#581311",
         },
         {
            db: "VULMON",
            id: "CVE-2015-6420",
         },
         {
            db: "BID",
            id: "78872",
         },
         {
            db: "BID",
            id: "77521",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-006448",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2015-005930",
         },
         {
            db: "PACKETSTORM",
            id: "134752",
         },
         {
            db: "PACKETSTORM",
            id: "140605",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-421",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201511-241",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-420",
         },
         {
            db: "NVD",
            id: "CVE-2015-6420",
         },
      ],
   },
   sources_release_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2018-09-26T00:00:00",
            db: "CERT/CC",
            id: "VU#581311",
         },
         {
            date: "2015-12-15T00:00:00",
            db: "VULMON",
            id: "CVE-2015-6420",
         },
         {
            date: "2015-12-09T00:00:00",
            db: "BID",
            id: "78872",
         },
         {
            date: "2015-11-08T00:00:00",
            db: "BID",
            id: "77521",
         },
         {
            date: "2015-12-18T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2015-006448",
         },
         {
            date: "2015-11-17T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2015-005930",
         },
         {
            date: "2015-12-10T17:22:52",
            db: "PACKETSTORM",
            id: "134752",
         },
         {
            date: "2017-01-19T13:56:50",
            db: "PACKETSTORM",
            id: "140605",
         },
         {
            date: "2015-11-08T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201512-421",
         },
         {
            date: "2015-11-23T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201511-241",
         },
         {
            date: "2015-12-15T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201512-420",
         },
         {
            date: "2015-12-15T05:59:07.823000",
            db: "NVD",
            id: "CVE-2015-6420",
         },
      ],
   },
   sources_update_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2018-11-08T00:00:00",
            db: "CERT/CC",
            id: "VU#581311",
         },
         {
            date: "2023-11-07T00:00:00",
            db: "VULMON",
            id: "CVE-2015-6420",
         },
         {
            date: "2018-09-27T06:00:00",
            db: "BID",
            id: "78872",
         },
         {
            date: "2015-12-08T22:09:00",
            db: "BID",
            id: "77521",
         },
         {
            date: "2018-09-28T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2015-006448",
         },
         {
            date: "2018-02-07T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2015-005930",
         },
         {
            date: "2015-12-18T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201512-421",
         },
         {
            date: "2015-11-24T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201511-241",
         },
         {
            date: "2021-05-28T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201512-420",
         },
         {
            date: "2023-11-07T02:26:50.673000",
            db: "NVD",
            id: "CVE-2015-6420",
         },
      ],
   },
   threat_type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "remote",
      sources: [
         {
            db: "PACKETSTORM",
            id: "134752",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-421",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201511-241",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201512-420",
         },
      ],
      trust: 1.9,
   },
   title: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/title#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "TP-Link EAP Controller lacks RMI authentication and is vulnerable to deserialization attacks",
      sources: [
         {
            db: "CERT/CC",
            id: "VU#581311",
         },
      ],
      trust: 0.8,
   },
   type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Input Validation Error",
      sources: [
         {
            db: "BID",
            id: "78872",
         },
         {
            db: "BID",
            id: "77521",
         },
      ],
      trust: 0.6,
   },
}

{
   document: {
      aggregate_severity: {
         text: "hoch",
      },
      category: "csaf_base",
      csaf_version: "2.0",
      distribution: {
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "de-DE",
      notes: [
         {
            category: "legal_disclaimer",
            text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.",
         },
         {
            category: "description",
            text: "IBM InfoSphere Information Server ist eine Softwareplattform zur Integration heterogener Daten.",
            title: "Produktbeschreibung",
         },
         {
            category: "summary",
            text: "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            title: "Angriff",
         },
         {
            category: "general",
            text: "- UNIX\n- Linux\n- Windows",
            title: "Betroffene Betriebssysteme",
         },
      ],
      publisher: {
         category: "other",
         contact_details: "csaf-provider@cert-bund.de",
         name: "Bundesamt für Sicherheit in der Informationstechnik",
         namespace: "https://www.bsi.bund.de",
      },
      references: [
         {
            category: "self",
            summary: "WID-SEC-W-2022-1738 - CSAF Version",
            url: "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1738.json",
         },
         {
            category: "self",
            summary: "WID-SEC-2022-1738 - Portal Version",
            url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1738",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin 7038982 vom 2023-09-28",
            url: "https://www.ibm.com/support/pages/node/7038982",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829353 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829353",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829371 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829371",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829373 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829373",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829335 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829335",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829311 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829311",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829369 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829369",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829325 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829325",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829365 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829365",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829361 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829361",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829339 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829339",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829349 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829349",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829363 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829363",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin: 6829327 vom 2022-10-16",
            url: "https://www.ibm.com/support/pages/node/6829327",
         },
         {
            category: "external",
            summary: "IBM Security Bulletin 6955819 vom 2023-02-15",
            url: "https://www.ibm.com/support/pages/node/6955819",
         },
      ],
      source_lang: "en-US",
      title: "IBM InfoSphere Information Server: Mehrere Schwachstellen",
      tracking: {
         current_release_date: "2023-09-27T22:00:00.000+00:00",
         generator: {
            date: "2024-08-15T17:36:32.285+00:00",
            engine: {
               name: "BSI-WID",
               version: "1.3.5",
            },
         },
         id: "WID-SEC-W-2022-1738",
         initial_release_date: "2022-10-16T22:00:00.000+00:00",
         revision_history: [
            {
               date: "2022-10-16T22:00:00.000+00:00",
               number: "1",
               summary: "Initiale Fassung",
            },
            {
               date: "2022-11-03T23:00:00.000+00:00",
               number: "2",
               summary: "CVE ergänzt",
            },
            {
               date: "2023-02-15T23:00:00.000+00:00",
               number: "3",
               summary: "Neue Updates von IBM aufgenommen",
            },
            {
               date: "2023-09-27T22:00:00.000+00:00",
               number: "4",
               summary: "Neue Updates von IBM aufgenommen",
            },
         ],
         status: "final",
         version: "4",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  category: "product_name",
                  name: "IBM InfoSphere Information Server 11.7",
                  product: {
                     name: "IBM InfoSphere Information Server 11.7",
                     product_id: "444803",
                     product_identification_helper: {
                        cpe: "cpe:/a:ibm:infosphere_information_server:11.7",
                     },
                  },
               },
               {
                  category: "product_name",
                  name: "IBM QRadar SIEM",
                  product: {
                     name: "IBM QRadar SIEM",
                     product_id: "T021415",
                     product_identification_helper: {
                        cpe: "cpe:/a:ibm:qradar_siem:-",
                     },
                  },
               },
            ],
            category: "vendor",
            name: "IBM",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2009-0217",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2009-0217",
      },
      {
         cve: "CVE-2009-2625",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2009-2625",
      },
      {
         cve: "CVE-2012-0881",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2012-0881",
      },
      {
         cve: "CVE-2012-2098",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2012-2098",
      },
      {
         cve: "CVE-2013-2172",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2013-2172",
      },
      {
         cve: "CVE-2013-4002",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2013-4002",
      },
      {
         cve: "CVE-2013-4517",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2013-4517",
      },
      {
         cve: "CVE-2015-4852",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2015-4852",
      },
      {
         cve: "CVE-2015-6420",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2015-6420",
      },
      {
         cve: "CVE-2015-7501",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2015-7501",
      },
      {
         cve: "CVE-2017-15708",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2017-15708",
      },
      {
         cve: "CVE-2019-13116",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2019-13116",
      },
      {
         cve: "CVE-2021-33813",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2021-33813",
      },
      {
         cve: "CVE-2021-36373",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2021-36373",
      },
      {
         cve: "CVE-2021-36374",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2021-36374",
      },
      {
         cve: "CVE-2021-40690",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2021-40690",
      },
      {
         cve: "CVE-2021-41089",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2021-41089",
      },
      {
         cve: "CVE-2021-41091",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2021-41091",
      },
      {
         cve: "CVE-2022-22442",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-22442",
      },
      {
         cve: "CVE-2022-23437",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-23437",
      },
      {
         cve: "CVE-2022-24769",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-24769",
      },
      {
         cve: "CVE-2022-30608",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-30608",
      },
      {
         cve: "CVE-2022-30615",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-30615",
      },
      {
         cve: "CVE-2022-31129",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-31129",
      },
      {
         cve: "CVE-2022-35642",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-35642",
      },
      {
         cve: "CVE-2022-35717",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-35717",
      },
      {
         cve: "CVE-2022-36109",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-36109",
      },
      {
         cve: "CVE-2022-40235",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-40235",
      },
      {
         cve: "CVE-2022-40747",
         notes: [
            {
               category: "description",
               text: "In IBM InfoSphere Information Server existieren mehrere Schwachstellen. Diese sind teilweise auf Fehler in Komponenten des Produktes zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.",
            },
         ],
         product_status: {
            known_affected: [
               "444803",
               "T021415",
            ],
         },
         release_date: "2022-10-16T22:00:00.000+00:00",
         title: "CVE-2022-40747",
      },
   ],
}