Security Bulletin: WebSphere Application Server is vulnerable to a denial of service which can impact IBM Engineering Lifecycle Management (ELM) products based on IBM Jazz technology

Summary WebSphere Application Server is vulnerable to a denial of service CVE-2021-38951. This may affect IBM Engineering Products based on IBM Jazz technology. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

CVE-2013-3024: Undefined Security Weakness

IBM WebSphere Application Server WAS 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process initialization. IBM X-Force ID: 84362...

CVE-2016-0378: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception...

CVE-2016-3042: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in IBM WebSphere Application Server WAS Liberty before 16.0.0.3 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving OpenID Connect clients...

PT-2016-5339

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty versions prior to 16.0.0.3 Description A cross-site scripting XSS issue exists in the Web UI of IBM WebSphere Application Server WAS Liberty, allowing remote authenticated users to inject arbitrary...

CVE-2016-3040: URL Redirection to Untrusted Site

IBM WebSphere Application Server WAS Liberty, as used in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-0283: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the OpenID Connect OIDC client web application in IBM WebSphere Application Server WAS Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-1920: Improper Access Control

IBM WebSphere Application Server WAS 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session...

CVE-2015-0175: Undefined Security Weakness

IBM WebSphere Application Server WAS 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors...

CVE-2014-3021: Improper Input Validation

IBM WebSphere Application Server WAS 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properly handle HTTP headers, which allows remote attackers to obtain sensitive cookie and authentication data via an unspecified HTTP method...

CVE-2014-4767: Improper Control of Generation of Code

IBM WebSphere Application Server WAS Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors...

CVE-2014-0965: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted SOAP response...

CVE-2014-4764: Undefined Security Weakness

IBM WebSphere Application Server WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3, when Load Balancer for IPv4 Dispatcher is enabled, allows remote attackers to cause a denial of service Load Balancer crash via unspecified vectors...

CVE-2014-0891: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information by leveraging incorrect request handling by the 1 Proxy or 2 ODR server...

CVE-2014-0896: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a crafted request...

PT-2013-4785

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions prior to 8.5.5.1 Description The issue allows local users to obtain sensitive information via standard filesystem operations due to weak permissions for unspecified files...

CVE-2013-4006: Undefined Security Weakness

IBM WebSphere Application Server WAS Liberty Profile 8.5 before 8.5.5.1 uses weak permissions for unspecified files, which allows local users to obtain sensitive information via standard filesystem operations...

CVE-2013-5418: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 7.0 before 7.0.0.31, 8.0 before 8.0.0.8, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-2967: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2013-2416

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions 8.5.0.0 through 8.5.0.1 Description The issue is related to the improper validation of authentication cookies when SSL is not enabled. This allows remote authenticated users to bypa...