OOpen Mainframe Project

Products

Exploited and recent CVEs

• CVE-2024-9802 Medium 5.3 Conformance validation endpoint discloses detail about service to unauthenticated users 0.2%
• CVE-2024-9798 Medium 5.3 Health endpoint offers list of onboarded services to unauthenticated users 0.2%
• CVE-2024-6916 Medium 5.9 Zowe CLI --show-inputs-only displays securely stored properties 0.1%
• CVE-2024-6834 Critical 9.0 Imperative Local Command Injection allows Activity Masking 0.3%
• CVE-2024-6833 Medium 5.9 Zowe CLI Auto-Init Leaks Credentials Locally 0.1%
• CVE-2021-4326 Low 3.3 Imperative Local Command Injection allows Activity Masking 0.3%
• CVE-2021-4314 Medium 5.3 It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have 0.5%