CVE-2015-0176

Cross-site scripting XSS vulnerability in MQ XR WebSockets Listener in WMQ Telemetry in IBM WebSphere MQ 8.0 before 8.0.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URI that is included in an error response...

CVE-2015-0176

CVE-2015-0176 describes a reflected cross-site scripting (XSS) vulnerability in the IBM WebSphere MQ XR WebSockets Listener. According to IBM and NVD sources, the issue arises from improper validation/sanitation of user-supplied input in the URI, which can be included in an error response and cau...

CVE-2015-0174

The SNMP implementation in IBM WebSphere Application Server WAS 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2015-0174

The CVE-2015-0174 issue affects IBM WebSphere Application Server (WAS) SNMP handling. The SNMP implementation in WAS 8.5 before 8.5.5.5 fails to properly handle configuration data, allowing remote authenticated users to obtain sensitive information via unspecified vectors. The connected IBM bulle...

CVE-2015-1882

Multiple race conditions in IBM WebSphere Application Server WAS 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user...

CVE-2015-0175

CVE-2015-0175 affects IBM WebSphere Application Server Liberty Profile before 8.5.5.5. Root cause: incorrect handling of authData elements, allowing remote authenticated users to gain privileges via unspecified vectors. Impact and remediation are documented: apply Fix Pack/Interim Fix for WAS Lib...

CVE-2015-1886

CVE-2015-1886 affects IBM WebSphere Portal via the Remote Document Conversion Service (DCS): versions 6.1.0–6.1.0.6 CF27, 6.1.5–6.1.5.3 CF27, 7.0.0–7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05 are vulnerable to memory consumption-based denial of service from crafted requests. T...

CVE-2015-1886

The Remote Document Conversion Service DCS in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05 allows remote attackers to cause a denial of service memory consumption via crafted requests...

CVE-2015-1908

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05, as used in Web Content Manager and other products, allows remote attackers to inject arbitrary web...

IBM WebSphere Portal Multiple Vulnerabilities (PI37356, PI37661)

The IBM WebSphere Portal installed on the remote host is version 6.1.0.x prior to 6.1.0.6 CF27, 6.1.5.x prior to 6.1.5.3 CF27, 7.0.0.x prior to 7.0.0.2 CF29, 8.0.0.x prior to 8.0.0.1 CF16, or 8.5.0.0 prior to 8.5.0.0 CF05. It is, therefore, affected by multiple vulnerabilities : - An unspecified...

IBM WebSphere Portal Unspecified Reflected XSS (PI30620)

The version of IBM WebSphere Portal installed on the remote host is affected by an unspecified cross-site scripting vulnerability due to improper validation of user-supplied input. A remote attacker can exploit this flaw using a specially crafted URL to execute arbitrary script code in a user's w...

Unspecified Request Handling Denial of Service Vulnerability in IBM WebSphere Portal

IBM WebSphere Portal consists of middleware, applications called portlets and development tools for building and managing secure business-to-business B2B, business-to-customer B2C and business-to-employee B2E portals. An unspecified request handling denial of service vulnerability exists in IBM...

IBM WebSphere DataPower XC10 appliance session hijacking vulnerability

The IBM WebSphere DataPower XC10 Appliance is a solution that combines the powerful DataPower hardware platform with IBM's distributed caching technology. A security vulnerability exists in the IBM WebSphere DataPower XC10 Appliance that allows remote attackers to hijack arbitrary user sessions t...

Design/Logic Flaw

The IBM WebSphere DataPower XC10 appliance 2.1 before 2.1.0.3 allows remote attackers to hijack the sessions of arbitrary users, and consequently obtain sensitive information or modify data, via unspecified vectors...

IBM WebSphere Portal 8.0.0.x < 8.0.0.1 CF15 / 8.5.0.0 < 8.5.0.0 CF05 Multiple XSRF / XSS (PI34987, PI33329, PI35228)

The version of IBM WebSphere Portal installed on the remote host is 8.0.0.x prior to 8.0.0.1 Cumulative Fix 15 / 8.5.0.0 prior to 8.5.0.0 Cumulative Fix 05. It is, therefore, affected by multiple vulnerabilities : - An unspecified XSRF vulnerability exists due to improper validation of...

IBM WebSphere Application Server 7.0 < Fix Pack 37 Multiple Vulnerabilities (POODLE)

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to Fix Pack 37. It is, therefore, affected by the following vulnerabilities : - A man-in-the-middle MitM information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles...

CVE-2015-0177

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-0139

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-0133

IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2014-6214

Cross-site request forgery CSRF vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...