https://vulnogram.org/ Most recent CVEs assigned by Zowe (zowe). https://vulnogram.org/seaview/icons/zowe.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2024-9802 https://vulnogram.org/CVE-2024-9802 The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the runn… Medium Thu, 10 Oct 2024 07:41:03 GMT https://vulnogram.org/CVE-2024-9798 https://vulnogram.org/CVE-2024-9798 The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers. Medium Thu, 10 Oct 2024 07:29:10 GMT https://vulnogram.org/CVE-2024-6916 https://vulnogram.org/CVE-2024-6916 A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the '--show-inputs-only' flag. Medium Fri, 19 Jul 2024 10:47:07 GMT https://vulnogram.org/CVE-2024-6834 https://vulnogram.org/CVE-2024-6834 A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any crede… Critical Wed, 17 Jul 2024 14:44:06 GMT https://vulnogram.org/CVE-2024-6833 https://vulnogram.org/CVE-2024-6833 A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation. Medium Wed, 17 Jul 2024 14:41:37 GMT https://vulnogram.org/CVE-2021-4326 https://vulnogram.org/CVE-2021-4326 A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI. Low Wed, 22 Feb 2023 15:21:06 GMT https://vulnogram.org/CVE-2021-4314 https://vulnogram.org/CVE-2021-4314 It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.1… Medium Network Exploitable Wed, 18 Jan 2023 15:23:42 GMT