CVE-2013-0544

CVE-2013-0544 affects IBM WebSphere Application Server: directory traversal via the Administrative Console can let remote authenticated users modify data. Affected on Linux/UNIX, with WAS versions and patch levels as follows: 6.1 up to but not including 6.1.0.47; 7.0 up to but not including 7.0.0...

CVE-2013-0540

CVE-2013-0540 : IBM WebSphere Application Server Liberty Profile 8.5 before 8.5.0.2 has an authentication cookie validation flaw when SSL is not enabled, allowing remote authenticated users to bypass access controls via an HTTP session. The connected IBM advisories indicate the remediation is to ...

CVE-2013-0543

CVE-2013-0543 affects IBM WebSphere Application Server (WAS) across 6.1 (pre-6.1.0.47), 7.0 (pre-7.0.0.29), 8.0 (pre-8.0.0.6), and 8.5 (pre-8.5.0.2) on Linux, Solaris, and HP-UX. Root cause: improper validation of a user via Local OS registries allows remote bypass of access controls. Remediation...

CVE-2013-0541

CVE-2013-0541 describes a buffer overflow in IBM WebSphere Application Server when using WebSphere Identity Manager with a local OS registry, on Windows, allowing a local attacker to crash the daemon (DoS). Affected versions (Windows): WAS 6.1 prior to 6.1.0.47, WAS 7.0 prior to 7.0.0.29, WAS 8.0...

CVE-2013-0540: Improper Authentication

IBM WebSphere Application Server WAS Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session...

CVE-2013-0541: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Windows, when a localOS registry is used in conjunction with WebSphere Identity Manger WIM, allows local users to cause a denial of service daemon crash...

PT-2013-2428

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions prior to 8.5.0.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted response. This affects the RPC adapter for the Web 2...

PT-2013-2417

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 before 6.1.0.47 IBM WebSphere Application Server versions 7.0 before 7.0.0.29 IBM WebSphere Application Server versions 8.0 before 8.0.0.6 IBM WebSphere Application Server versions 8.5 before 8.5.0...

CVE-2013-0544: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Administrative Console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux and UNIX allows remote authenticated users to modify data via unspecified vectors...

PT-2013-2420 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 6.1 before 6.1.0.47 IBM WebSphere Application Server versions 7.0 before 7.0.0.29 IBM WebSphere Application Server versions 8.0 before 8.0.0.6 IBM WebSphere Application Server versions 8.5 before...

CVE-2013-0565: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the RPC adapter for the Web 2.0 and Mobile toolkit in IBM WebSphere Application Server WAS 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted response...

PT-2013-2416

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions 8.5.0.0 through 8.5.0.1 Description The issue is related to the improper validation of authentication cookies when SSL is not enabled. This allows remote authenticated users to bypa...

CVE-2013-0543: Incorrect Authorization

IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux, Solaris, and HP-UX, when a Local OS registry is used, does not properly validate user accounts, which allows remote attackers to bypass intended access restrictions...

PT-2013-2418

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 before 6.1.0.47 IBM WebSphere Application Server versions 7.0 before 7.0.0.29 IBM WebSphere Application Server versions 8.0 before 8.0.0.6 IBM WebSphere Application Server versions 8.5 before 8.5.0...

CVE-2013-0542: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via crafted field values...

CVE-2013-1168: Undefined Security Weakness

The web server in Cisco Unified MeetingPlace Application Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 Patch 1 does not invalidate a session upon a logout action, which makes it easier for remote attackers to hijack sessions by leveraging knowledge of a sessio...

PT-2013-2936

Name of the Vulnerable Software and Affected Versions Cisco Unified MeetingPlace Application Server versions 7.0 through 7.1MR1 Patch 1 Cisco Unified MeetingPlace Application Server versions 8.0 through 8.0MR1 Patch 0 Cisco Unified MeetingPlace Application Server versions 8.0 through 8.5MR2 Patch...

Microsoft Windows CVE-2013-1291 OpenType Font Parsing Remote Denial of Service Vulnerability

Description Microsoft Windows is prone to a remote denial-of-service vulnerability. Successful exploits will allow attackers to cause the affected computer to stop responding and reboot, resulting in a denial-of-service condition. Technologies Affected Avaya Aura Conferencing 6.0 SP1 Standard Ava...

Microsoft Windows CVE-2013-1293 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to gain elevated privileges and run arbitrary code in kernel mode. Technologies Affected Avaya Aura Conferencing 6.0 SP1 Standard Avaya Aura Conferencing 6.0.0 Standard Ava...

Microsoft Internet Explorer CVE-2013-1304 Use-After-Free Remote Code Execution Vulnerability

Description Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in...