PT-2013-2356

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 before 6.1.0.47 IBM WebSphere Application Server versions 7.0 before 7.0.0.27 IBM WebSphere Application Server versions 8.0 before 8.0.0.6 IBM WebSphere Application Server versions 8.5 before 8.5.0...

CVE-2013-0461: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the virtual member manager VMM administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecifi...

PT-2013-2357

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 Description The issue concerns an unspecified vulnerability with unknown impact and attack vectors. Recommendations For versions 6.1, 7.0 before 7.0.0.27, 8.0, an...

PT-2013-2355

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 before 6.1.0.47 IBM WebSphere Application Server versions 7.0 before 7.0.0.27 Description A cross-site request forgery CSRF issue exists in the portlet subsystem of the administrative console,...

WebSphere Application Server (WAS) vulnerable to cross-site scripting

Overview WebSphere Application Server WAS provided by IBM contains a cross-site scripting vulnerability. WebSphere Application Server WAS provided by IBM contains a vulnerability in SnoopServlet, which may result in a cross-site scripting. Eiji James Yoshida of Security Professionals Network Inc...

JVN#24343509: WebSphere Application Server (WAS) vulnerable to cross-site scripting

WebSphere Application Server WAS provided by IBM contains a vulnerability in SnoopServlet, which may result in a cross-site scripting. Impact An arbitrary script may be executed on the user's web browser. Solution Apply a patch Apply the patch according to the information provided by the develope...

IBM WebSphere Application Server 7.0 < Fix Pack 27 Multiple Vulnerabilities

IBM WebSphere Application Server 7.0 before Fix Pack 27 appears to be running on the remote host. It is, therefore, potentially affected by the following vulnerabilities : - A request validation error exists related to the proxy server component that could allow a remote attacker to cause the pro...

JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing

twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments...

RHEL 4 : JBoss EAP (RHSA-2010:0376)

Updated JBoss Enterprise Application Platform JBEAP 4.2 packages that fix three security issues and multiple bugs are now available for Red Hat Enterprise Linux 4 as JBEAP 4.2.0.CP09. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability...

CVE-2012-1677

Technical details about CVE-2012-1677 are not publicly available in the provided documents. Monitor for updates from Oracle and CVE repositories for affected products, versions, and remediation.

CVE-2012-1677: Undefined Security Weakness

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via unknown vectors...

PT-2013-1528

Name of the Vulnerable Software and Affected Versions Oracle Application Server Single Sign-On affected versions not specified Description The issue affects the integrity of the system, allowing remote attackers to exploit it via unknown vectors. No information is available about the estimated...

Default application files available for download via the application server.

see: https://jira.atlassian.com/browse/JRA-31187 e.g. https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/ and https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/web.xml . FishEye shouldn't write any user data to the WEB-INF directory. The only files which are viewable there, should be the sam...

Default application files available for download via the application server.

see: https://jira.atlassian.com/browse/JRA-31187 e.g. https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/ and https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/web.xml . FishEye shouldn't write any user data to the WEB-INF directory. The only files which are viewable there, should be the sam...

IBM WebSphere Application Server for z/OS HTTP Server组件任意命令执行漏洞

BUGTRAQ ID: 57010 CVECAN ID: CVE-2012-5955 WebSphere是IBM的集成软件平台。它包含了编写、运行和监视全天候的工业强度的随需应变Web应用程序和跨平台、跨产品解决方案所需要的整个中间件基础设施，如服务器、服务和工具。 IBM WebSphere Application Server for z/OS 5.3及其他版本在HTTP服务器组件5.3版本内存在安全漏洞，可允许远程攻击者执行任意命令。 0 IBM Websphere Application Server 5.x 厂商补丁： IBM ---...

CVE-2012-5955

Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server WAS for z/OS allows remote attackers to execute arbitrary commands via unknown vectors...

CVE-2012-3428

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...

Code injection

Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server WAS for z/OS allows remote attackers to execute arbitrary commands via unknown vectors...

CVE-2012-3428

The CVE-2012-3428 issue affects the IronJacamar container prior to 1.0.12.Final used with JBoss AS. When allow-multiple-users is enabled alongside a security domain, the credentials passed to getConnection are not used, potentially enabling an attacker to obtain access to an arbitrary datasource ...

CVE-2012-3428

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...