PT-2015-5508

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x through 7.0.0.38 IBM WebSphere Application Server versions 8.0.x through 8.0.0.10 IBM WebSphere Application Server versions 8.5.x through 8.5.5.6 IBM WebSphere Virtual Enterprise version 7.0.0.6 an...

PT-2015-6728

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x through 7.0.0.38 IBM WebSphere Application Server versions 8.0.x through 8.0.0.10 IBM WebSphere Application Server versions 8.5.x through 8.5.5.6 Description The issue allows remote attackers to...

WebSphere Application Server Privilege Escalation

The vulnerability of WebSphere Application Server applications is related to deficiencies in access control for certain functions. Exploiting this vulnerability can allow an attacker, operating locally, to increase their privileges due to errors in the configuration of access control rules...

WebSphere Application Server Privileged Access

The vulnerability of WebSphere Application Server applications is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain privileged access by manipulating the value of the object...

CVE-2015-1946

IBM WebSphere Application Server WAS 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server WAS 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors...

Default configuration

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...

Code injection

IBM WebSphere Application Server WAS 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server WAS 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors...

CVE-2015-1927

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...

CVE-2015-1927

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...

CVE-2015-1936

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

CVE-2015-1946

IBM WebSphere Application Server WAS 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server WAS 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors...

CVE-2015-1927

CVE-2015-1927 affects IBM WebSphere Application Server (and WAS bundled products). The root cause is a misconfigured WebContainer property, serveServletsByClassnameEnabled, which if not set correctly can allow a remote attacker to gain elevated privileges. Affected WAS versions include 7.0, 8.0, ...

CVE-2015-1946

CVE-2015-1946 affects IBM WebSphere Application Server (WAS) and WebSphere Virtual Enterprise. It enables local privilege escalation due to incorrect handling of user roles, with vulnerable versions including WAS 8.5 prior to 8.5.5.6 and WAS 7.0/8.0 prior to their respective fixes; remediation is...

CVE-2015-1936

CVE-2015-1936 concerns IBM WebSphere Application Server Administrative Console session hijacking when Security is disabled. A remote authenticated attacker could exploit this to hijack another user’s session via the JSESSIONID parameter. Affected products/versions from the sources include WAS 8.0...

Microsoft Internet Explorer CVE-2015-2397 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

Microsoft Windows Kernel 'Win32k.sys' CVE-2015-2363 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Avaya CallPilot 4.0 Avaya CallPilot 4.0.1 Avaya CallPilot 5.0 Avaya CallPilot 5.0....

Microsoft Internet Explorer CVE-2015-2411 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

CVE-2015-1927: Improper Access Control

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...

CVE-2015-1936: Improper Access Control

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

CVE-2015-1946: Undefined Security Weakness

IBM WebSphere Application Server WAS 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server WAS 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors...