IBM Iseries As 400 vulnerabilities

3 CVEs affecting IBM Iseries As 400, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2005-1238, published 2005-05-02.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2005-1025, published 2005-05-02. Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days. The FTP server in AS/400 4.3, when running in IFS mode, allows remote attackers to obtain sensitive information via a symlink attack using RCMD and the ADDLNK utility, as demonstrated using the…
• CVE-2005-1238, published 2005-05-02. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. By design, the built-in FTP server for iSeries AS/400 systems does not support a restricted document root, which allows attackers to read or write arbitrary files, including sensitive QSYS databases,…
• CVE-2005-1133, published 2005-05-02. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. The POP3 server in IBM iSeries AS/400 returns different error messages when the user exists or not, which allows remote attackers to determine valid user IDs on the server.