CVE-2014-6164

CVE-2014-6164 (IBM WebSphere Application Server) affects IBM WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4. A remote attacker can spoof OpenID/OpenID Connect cookies via a crafted URL, potentially exposing sensitive information. Affected products/versions are listed in the IBM bulletin; reme...

CVE-2014-6164

IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4 allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain sensitive information, via a crafted URL...

CVE-2014-6167: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-6164: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4 allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain sensitive information, via a crafted URL...

CVE-2014-6174: Undefined Security Weakness

IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2014-6166: Undefined Security Weakness

The Communications Enabled Applications CEA service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entit...

CVE-2014-8890: Undefined Security Weakness

IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations...

PT-2014-7080

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x through 7.0.0.36 IBM WebSphere Application Server versions 8.0.x through 8.0.0.9 IBM WebSphere Application Server versions 8.5.x through 8.5.5.3 Description A cross-site scripting XSS issue exists ...

PT-2014-7084

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0.0 through 7.0.0.36 IBM WebSphere Application Server versions 8.0.0 through 8.0.0.9 IBM WebSphere Application Server versions 8.5.0 through 8.5.5.3 Description The issue allows remote attackers to...

PT-2014-8747

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server Liberty Profile versions 8.5.x through 8.5.5.3 Description The issue allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and...

PT-2014-7079

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.0.0.0 through 8.0.0.9 IBM WebSphere Application Server versions 8.5.0.0 through 8.5.5.3 Feature Pack for CEA versions 1.0.0.0 through 1.0.0.14 Description The issue allows remote attackers to read...

PT-2014-7078

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.0.x through 8.0.0.9 IBM WebSphere Application Server versions 8.5.x through 8.5.5.3 Description The issue allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain...

SOL15904 - Multiple third-party application-server vulnerabilities

Recommended action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists. Supplemental...

Microsoft Internet Explorer CVE-2014-6373 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

Microsoft Internet Explorer CVE-2014-6330 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

Microsoft Internet Explorer CVE-2014-8966 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

Microsoft Internet Explorer CVE-2014-6329 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

Microsoft Internet Explorer CVE-2014-6366 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...

Microsoft Internet Explorer CVE-2014-6368 ASLR Security Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a security-bypass vulnerability. An attacker can leverage this issue to bypass certain security restrictions and execute arbitrary code by exploiting another vulnerability in the application. Internet Explorer 11 is vulnerable. Technologies...

Microsoft Internet Explorer CVE-2014-6374 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...