PT-2014-1410

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0.x through 7.0.0.32 IBM WebSphere Application Server versions 8.0.x through 8.0.0.8 IBM WebSphere Application Server versions 8.5.x through 8.5.5.1 Description The issue allows remote attackers to...

Directory Traversal Vulnerability With Certain Route Configurations

There is a vulnerability in the 'implicit render' functionality in Ruby on Rails.The implicit render functionality allows controllers to render a template, even if there is no explicit action with the corresponding name. This module does not perform adequate input sanitization which could allow a...

CVE-2013-6323

Cross-site scripting XSS vulnerability in the Administration Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or...

CVE-2014-0823

IBM WebSphere Application Server WAS 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL...

CVE-2014-0896

IBM WebSphere Application Server WAS Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request...

CVE-2014-0859

The web-server plugin in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service daemon crash via unspecified vectors...

Code injection

The web-server plugin in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service daemon crash via unspecified vectors...

Cross site request forgery (csrf)

IBM WebSphere Application Server WAS Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request...

Cross site scripting

Cross-site scripting XSS vulnerability in the Administration Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or...

CVE-2014-0823

IBM WebSphere Application Server WAS 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL...

CVE-2014-0896

IBM WebSphere Application Server WAS Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request...

CVE-2014-0859

The web-server plugin in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service daemon crash via unspecified vectors...

CVE-2014-0896

CVE-2014-0896 affects IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.2. The vulnerability allows a remote attacker to obtain sensitive information via a crafted request. Remediation per the connected bulletin is to upgrade to 8.5.5.2 or later (Liberty Profile). The connected ...

CVE-2014-0859

CVE-2014-0859 affects IBM WebSphere Application Server where the web server plugin configured to retry failed POST requests may cause a denial of service (daemon crash). Affected: WAS 7.x up to 7.0.0.33, WAS 8.x up to 8.0.0.9, WAS 8.5.x up to 8.5.5.2. Remediation: apply the corresponding Fix Pack...

CVE-2014-0823

CVE-2014-0823 affects IBM WebSphere Application Server (WAS) 8.x prior to 8.0.0.9 and 8.5.x prior to 8.5.5.2, allowing remote attackers to read arbitrary files via a crafted URL. The vulnerability is documented across multiple security bulletins and advisories (including IBM APARs PI05324/PI05324...

CVE-2014-0857

CVE-2014-0857 affects IBM WebSphere Application Server (WAS) Administrative Console. Affected versions: WAS 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2. Description: remote authenticated users can obtain sensitive information via a crafted request due to improper handling of requests in the Admin...

CVE-2014-0857

The Administrative Console in IBM WebSphere Application Server WAS 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote authenticated users to obtain sensitive information via a crafted request...

CVE-2013-6323: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Administration Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or...

CVE-2014-0823: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a crafted URL...

CVE-2014-0896: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request...