Open Mainframe Project Zowe
6 CVEs affecting Open Mainframe Project Zowe. Latest disclosed: 2024-10-10. Critical: 2, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-9798 | Critical | 9.0 | 2024-10-10 | The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers. |
CVE-2024-6834 | Critical | 9.0 | 2024-07-17 | A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows a… |
CVE-2024-6833 | Medium | 5.9 | 2024-07-17 | A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operatio… |
CVE-2024-9802 | Medium | 5.3 | 2024-10-10 | The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information ab… |
CVE-2021-4314 | Medium | 5.3 | 2023-01-18 | It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only… |
CVE-2021-4326 | Low | 3.3 | 2023-03-01 | A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or… |