Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

IBM WebSphere Portal 8.5.0 < 8.5.0 CF02 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the Apache Struts ClassLoader. A remote attacker can exploit this issue by manipulating the 'class' parameter of an ActionForm object to...

IBM WebSphere Portal Unspecified Information Disclosure (PI17768)

The version of IBM WebSphere Portal on the remote host is affected by an unspecified information disclosure vulnerability which allows a remote attacker to gain access to sensitive information. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid79217; scriptversion"1.4";...

CVE-2014-4834

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and application crash via a crafted XML document containing a large number of nest...

Code injection

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and application crash via a crafted XML document containing a large number of nest...

Xxe

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 allows remote authenticated users to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity...

CVE-2014-4834

IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.8 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and application crash via a crafted XML document containing a large number of nest...

CVE-2014-4834

IBM WebSphere Commerce (6.x up to 6.0.0.11 and 7.x up to 7.0.0.8) is affected by a vulnerability where recursion during XML entity expansion is not detected, allowing a remote attacker to cause memory/CPU exhaustion and an application crash via a crafted XML document with many nested entity refer...

IBM WebSphere Portal 8.5.0 < 8.5.0 CF03 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is affected by the multiple vulnerabilities : - Multiple vulnerabilities exist in the Apache Cordova component, including cross-application scripting, security bypass, and information disclosure. CVE-2014-3500, CVE-2014-3501,...

IBM WebSphere Portal Entity Expansion DoS (PI24622)

The version of IBM WebSphere Portal installed on the remote host is affected by a denial of service vulnerability. A flaw exists that is caused by improper recursion detection during entity expansion. By tricking a user into opening a specially crafted XML document, an attacker can cause the syst...

IBM WebSphere Portal 6.1.0.x < 6.1.0.6 CF27 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is 6.1.0.x prior 6.1.0.6 CF27. It is, therefore, affected by multiple vulnerabilities : - A cross-site scripting vulnerability exists in the 'bootconfig.jsp' script due to improper validation of user-supplied input. An attacker can...

IBM WebSphere Portal Unspecified Vulnerability (PI25993)

The version of IBM WebSphere Portal installed on the remote host is affected by an unspecified code execution vulnerability that allows an authenticated attacker to execute arbitrary code on the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

IBM WebSphere Portal 8.0.0.x < 8.0.0.1 CF14 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is affected by multiple vulnerabilities : - An unspecified information disclosure vulnerability exists which allows a remote attacker to gain access to sensitive information. CVE-2014-3083 - An information disclosure vulnerability...

IBM WebSphere Portal CKEditor XSS (PI24992, PI26456)

The version of IBM WebSphere Portal installed on the remote host is affected by a cross-site scripting vulnerability in the CKEditor component due to improper validation of user-supplied input. A remote attacker can exploit this flaw using a specially crafted URL to execute scripts in a user's we...

CVE-2014-6125

Cross-site request forgery CSRF vulnerability in IBM WebSphere Portal 8.5.0 before CF03 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2014-4814

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service memory and CPU...

CVE-2014-4808

Unspecified vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 allows remote authenticated users to execute arbitrary code via unknown vectors...

CVE-2014-4821

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 provides different web-server error codes depending on whether a requested file exists, which allows remote attackers to determine the validity of...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 8.5.0 before CF03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service memory and CPU...