CVE-2009-0508

The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server WAS 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in 1 web-inf, 2 meta-inf, and unspecified other...

CVE-2009-0508

IBM WebSphere Application Server (WAS) is affected by CVE-2009-0508. Affected versions include WAS 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3. The vulnerability allows remote attackers to read arbitrary files contained in WAR archives (notably in web-inf a...

Microsoft Windows Invalid Pointer Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successfully exploiting this issue will result in the complete compromise of affected...

Microsoft Windows WINS Server WPAD and ISATAP Access Validation Vulnerability

Description The Microsoft Windows WINS Server is prone to an access-validation vulnerability because the software fails to properly restrict access when defining WPAD Web Proxy Autodiscovery Protocol and ISATAP Intra-Site Automatic Tunnel Addressing Protocol entries. An authenticated attacker may...

Microsoft Windows Kernel Handle Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successfully exploiting this issue will result in the complete compromise of affected...

Microsoft Windows Kernel GDI EMF/WMF Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting victim to open a malicious EMF or WMF image file. Successfully exploiting this issue will allow attackers to execute arbitrary code with kernel-level...

Microsoft Windows DNS Server WPAD Access Validation Vulnerability

Description The Microsoft Windows DNS Server is prone to an access-validation vulnerability because the software fails to properly restrict access when defining WPAD Web Proxy Autodiscovery Protocol entries. An authenticated attacker may exploit this issue to create a WPAD DNS entry. This may aid...

CVE-2009-0856

Multiple cross-site scripting XSS vulnerabilities in sample applications in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.35, and 6.1 before 6.1.0.23 on z/OS, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0855

CVE-2009-0855 is an XSS vulnerability in IBM WebSphere Application Server 6.1, affecting the administrative console on z/OS before 6.1.0.23. The flaw allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected versions are 6.1.0.0 through 6.1.0.22; remediation...

PT-2009-3447 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server WAS versions 6.1.0.0 through 6.1.0.22 Description: A cross-site scripting XSS issue exists in the administrative console, allowing remote attackers to inject arbitrary web script or HTML. This could potentiall...

IBM Websphere Application Server 6.17.0 - Administrative Console Cross-Site Scripting

IBM Websphere Application Server 6.17.0 - Administrative Console Cross-Site Scripting source: https://www.securityfocus.com/bid/34001/info IBM WebSphere Application Server WAS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker m...

Design/Logic Flaw

Unspecified vulnerability in IBM WebSphere Application Server WAS 5.1 and 6.0.2 before 6.0.2.33 on z/OS, when CSIv2 Identity Assertion is enabled and Enterprise JavaBeans EJB interaction occurs between a WAS 6.1 instance and a WAS pre-6.1 instance, allows local users to have an unknown impact via...

CVE-2009-0506

CVE-2009-0506 affects IBM WebSphere Application Server 5.1 and 6.0.2 before 6.0.2.33 on z/OS when CSIv2 Identity Assertion is enabled and EJB interaction occurs between a WAS 6.1 instance and a pre-6.1 instance. The vulnerability allows local users to cause an unknown impact via two vectors: (1) ...

CVE-2009-0504

The CVE-2009-0504 issue affects IBM WebSphere Application Server 7.0.x (Web Services/WSPolicy). Before version 7.0.0.1, WSPolicy does not correctly recognize IDAssertion.isUsed, enabling local users to read a SOAP message and discover a password. The NVD entry notes a LOW impact with LOCAL access...

CVE-2008-4285

CVE-2008-4285 affects IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19, specifically the Servlet Engine/Web Container PMI feature. When a component statistic is enabled, it allows a denial of service (daemon crash) via vectors described as a gradual degradation in performance. No expl...

IBM WebSphere Application Server "PerfServlet"信息泄漏漏洞

BUGTRAQ ID: CVE ID：CVE-2008-5413 CNCVE ID：CNCVE-20085413 IBM WebSphere Application Server是一款商业性质的WEB应用服务程序。 IBM WebSphere Application Server "PerfServlet"参数处理存在问题，远程攻击者可以利用漏洞获得敏感信息。 目前没有详细解决方案提供。 IBM WebSphere Application Server 6.0.x 可参考如下安全公告获得补丁信息：...

IBM WebSphere Application Server 6.1 < Fix Pack 21 Multiple Flaws

IBM WebSphere Application Server 6.1 before Fix Pack 21 appears to be running on the remote host. As such, it is reportedly affected by multiple flaws : - Provided Performance Monitoring Infrastructure PMI is enabled, it may be possible for a local attacker to obtain sensitive information through...

Code injection

The 1 modibmssl and 2 modcgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server WAS, set incorrect permissions for AFUNIX sockets, which has unknown impact and local attack vectors...

CVE-2008-4284

Open redirect vulnerability in the ibmsecuritylogout servlet in IBM WebSphere Application Server WAS 5.1.1.19 and earlier 5.x versions, 6.0.x before 6.0.2.33, and 6.1.x before 6.1.0.23 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the...

Open redirect

Open redirect vulnerability in the ibmsecuritylogout servlet in IBM WebSphere Application Server WAS 5.1.1.19 and earlier 5.x versions, 6.0.x before 6.0.2.33, and 6.1.x before 6.1.0.23 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the...