Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Xxe

IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2015-0139

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-0177

CVE-2015-0177 is an XSS vulnerability in IBM WebSphere Portal. The issue affects WebSphere Portal 8.5.0 before CF05 (and related 8.0.x/CF patches per Nessus note) where a crafted URL enables remote authenticated users to inject arbitrary script or HTML in a user’s browser. The root cause is impro...

CVE-2014-6214

Cross-site request forgery CSRF vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2015-0177

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-0133

IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

IBM WebSphere Cross-Site Scripting Vulnerability (CNVD-2015-01723)

IBM WebSphere Portal provides a framework for combining application or business mashups and provides a high-level tool to construct flexible, SOA-based solutions. A cross-site scripting vulnerability exists in IBM WebSphere Portal, which can be exploited by a remote attacker to construct maliciou...

IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2015-01273)

IBM WebSphere Portal provides a framework for combining application or business mashups and provides a high-level tool to construct flexible, SOA-based solutions. A cross-site scripting vulnerability exists in IBM WebSphere Portal, which allows remote attackers to exploit the vulnerability to...

IBM WebSphere Application Server 8.0 < Fix Pack 10 Multiple Vulnerabilities (POODLE)

The remote host is running IBM WebSphere Application Server version 8.0 prior to Fix Pack 10. It is, therefore, affected by the following vulnerabilities : - Multiple errors exist related to the included IBM HTTP server that can allow remote code execution or denial of service. CVE-2013-5704,...

CVE-2014-8909

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF29, 8.0.0.x before 8.0.0.1 CF15, and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF29, 8.0.0.x before 8.0.0.1 CF15, and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-8909

CVE-2014-8909 is an XSS vulnerability in IBM WebSphere Portal. Improper validation of user-supplied input allows remote authenticated users to inject arbitrary script or HTML via a crafted URL. Affected versions listed in the sources include WebSphere Portal 6.1.0.x (up to 6.1.0.6 CF27), 6.1.5.x ...

CVE-2014-4771

CVE-2014-4771 affects IBM WebSphere MQ: remote authenticated users can exhaust queue slots via a crafted PCF query, impacting MQ servers in versions 7.0.1 before 7.0.1.13, 7.1 before 7.1.0.6, 7.5 before 7.5.0.5, and 8 before 8.0.0.1. The connected documents confirm the affected versions and the D...

CVE-2014-8909

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF29, 8.0.0.x before 8.0.0.1 CF15, and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Design/Logic Flaw

The HTTPInput node in IBM WebSphere Message Broker 7.0 before 7.0.0.8 and 8.0 before 8.0.0.6 and IBM Integration Bus 9.0 before 9.0.0.4 allows remote attackers to obtain sensitive information by triggering a SOAP fault...

IBM WebSphere Service Registry and Repository 8.0 < 8.0.0.3 Multiple Vulnerabilities

The version of IBM WebSphere Service Registry and Repository WSRR is version 8.0 prior to 8.0.0.3. It is therefore, affected by multiple vulnerabilities : - An unspecified DOM based cross-site scripting XSS vulnerability in the WSRR web UI. CVE-2014-6132 - WSSR web interface issues a cookie that ...

IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.4 Multiple Vulnerabilities (POODLE)

The IBM WebSphere Application Server running on the remote host is version 8.5 prior to Fix Pack 8.5.5.4. It is, therefore, affected by the following vulnerabilities : - Multiple errors exist related to the included IBM HTTP server that can allow remote code execution or denial of service...

CVE-2014-6160

IBM WebSphere Service Registry and Repository WSRR 8.5 before 8.5.0.1, when Chrome and WebSEAL are used, does not properly process ServiceRegistryDashboard logout actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation...

CVE-2014-6160

IBM WebSphere Service Registry and Repository WSRR 8.5 before 8.5.0.1, when Chrome and WebSEAL are used, does not properly process ServiceRegistryDashboard logout actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation...