WebSphere Application Server Information Disclosure

The vulnerability of the Admin Center component of WebSphere Application Server is related to the lack of protection for operational data. Exploiting this vulnerability may allow a malicious actor to obtain confidential information from a remote location...

WebSphere Application Server Header Injection

The vulnerability of WebSphere Application Server for application servers exists due to the lack of measures to address the CRLF sequence return with a line break. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP headers using a specially crafted URL...

Critical: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.9 update

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

IBM WebSphere Application Server Liberty Multiple Liberty Vulnerabilities (Jul 2016)

IBM WebSphere Application Server Liberty is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-2945

The API Discovery implementation in IBM WebSphere Application Server WAS 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document...

CVE-2016-2945

The API Discovery implementation in IBM WebSphere Application Server WAS 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document...

CVE-2016-2945

CVE-2016-2945 affects IBM WebSphere Application Server Liberty (8.5.5.8–8.5.5.9) before Liberty Fix Pack 16.0.0.2. Root cause: API Discovery feature in Liberty evaluates Swagger documents with external references, enabling an authenticated remote user to gain privileges via an external reference....

CVE-2016-2945: Undefined Security Weakness

The API Discovery implementation in IBM WebSphere Application Server WAS 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to gain privileges via an external reference in a Swagger document...

PT-2016-2310

Name of the Vulnerable Software and Affected Versions WebSphere Application Server versions 8.5.5.8 through 8.5.5.9 Description The issue is related to the implementation of the API Discovery server in WebSphere Application Server, which is associated with insufficient access control. This can be...

CVE-2016-2923

IBM WebSphere Application Server WAS 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script acces...

CVE-2016-0389

Admin Center in IBM WebSphere Application Server WAS 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensitive information via unspecified vectors...

Design/Logic Flaw

IBM WebSphere Application Server WAS 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script acces...

CVE-2016-0389

Admin Center in IBM WebSphere Application Server WAS 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2016-2923

IBM WebSphere Application Server WAS 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script acces...

CVE-2016-2923

CVE-2016-2923 affects IBM WebSphere Application Server Liberty (JAX-RS API cookies) where HTTPOnly flag is not set, enabling remote attackers to read cookies and potentially access sensitive data. Affected: WebSphere Application Server 8.5.x (8.5–8.5.5.9) and Liberty prior to 16.0.0.2. CVSSv3.0 v...

CVE-2016-2923: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script acces...

CVE-2016-0389: Exposure of Sensitive Information to an Unauthorized Actor

Admin Center in IBM WebSphere Application Server WAS 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensitive information via unspecified vectors...

PT-2016-2327

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 Description The issue is related to the lack of protection for service data in the Admin Center component of the WebSphere Applicati...

PT-2016-2311

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 Description The issue is related to the absence of the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie. This...

SAP NetWeaver Application Server Compromise Security

The vulnerability of SAP NetWeaver Application Server is related to errors in the processing of XML requests. Exploiting this vulnerability allows a malicious actor to compromise information security by sending specially crafted TCP and XML requests remotely...