Zowe: CVE Program partner

CVEs, 365 days07 all time, 0 rejected

Quality-median 99%

CVSS by the CNA-share of records

CWE-share of records

Affected versions-not n/a or unspecified

CVSS added by CISA-lower is better

Organisation	Zowe
Role	CNA
Type	Open Source
Reports to	mitre
Scope	Vulnerabilities in <a href='https://zowe.org' target='_blank'>Zowe.org</a> open source projects.
Advisories	https://github.com/zowe/community/security/advisories

CVE-2024-9802 2024-10-10 · CVSS 5.3
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information abo
CVE-2024-9798 2024-10-10 · CVSS 5.3
The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers.
CVE-2024-6916 2024-07-19 · CVSS 5.9
A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the '--show-inputs-only'
CVE-2024-6834 2024-07-17 · CVSS 9.0
A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows ac
CVE-2024-6833 2024-07-17 · CVSS 5.9
A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation
CVE-2021-4326 2023-02-22 · CVSS 3.3
A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or
CVE-2021-4314 2023-01-18
It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only

Zowe