CVE-2013-0466

CVE-2013-0466 affects IBM WebSphere Message Broker (7.0 prior to 7.0.0.6 and 8.0 prior to 8.0.0.2) where wsdl support on a SOAPInput node can trigger cross-site scripting. The root cause is improper handling during construction of an error message, allowing remote script/HTML injection via a wsdl...

CVE-2013-0466

Cross-site scripting XSS vulnerability in IBM WebSphere Message Broker 7.0 before 7.0.0.6 and 8.0 before 8.0.0.2, when wsdl support is enabled on a SOAPInput node, allows remote attackers to inject arbitrary web script or HTML via a wsdl request that is not properly handled during construction of...

IBM WebSphere Application Server 8.0 < Fix Pack 5 Multiple Vulnerabilities

IBM WebSphere Application Server 8.0 before Fix Pack 5 appears to be running on the remote host. It is, therefore, potentially affected by the following vulnerabilities : - An unspecified error exists related to the Administrative Console that can allow an attacker to hijack sessions...

CVE-2013-0460

Cross-site request forgery CSRF vulnerability in the portlet subsystem in the administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47 and 7.0 before 7.0.0.27 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site...

CVE-2013-0459

Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0462

Unspecified vulnerability in IBM WebSphere Application Server WAS 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors...

CVE-2013-0458

Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2, when login security is disabled, allows remote attackers to inject arbitrary web script or HTML via...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the portlet subsystem in the administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47 and 7.0 before 7.0.0.27 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site...

Cross site scripting

Cross-site scripting XSS vulnerability in the virtual member manager VMM administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecifi...

Cross site scripting

Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

Unspecified vulnerability in IBM WebSphere Application Server WAS 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors...

CVE-2013-0462

Unspecified vulnerability in IBM WebSphere Application Server WAS 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors...

CVE-2013-0459

CVE-2013-0459 is an XSS vulnerability in the IBM WebSphere Application Server administrative console. The flaw allows remote attackers to inject arbitrary script/HTML via unspecified vectors. Affected versions include WAS 6.1 prior to 6.1.0.47, WAS 7.0 prior to 7.0.0.27, WAS 8.0 prior to 8.0.0.6,...

CVE-2013-0458

Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2, when login security is disabled, allows remote attackers to inject arbitrary web script or HTML via...

CVE-2013-0461

CVE-2013-0461 is an XSS in WebSphere Application Server's Virtual Member Manager (VMM) Administrative Console. Root cause: improper input validation in the administrative console, allowing a remote attacker to inject script via an error message. Affected versions (per IBM/DOC): WAS 6.1.0.46 and e...

CVE-2013-0462

CVE-2013-0462 is an IBM WebSphere Application Server vulnerability (improper validation) that could allow an authenticated remote attacker to bypass security. It affects WAS 6.1, 7.0 (up to but not including 7.0.0.27), 8.0, and 8.5. IBM security advisories (PM76886/PM79937) provide fixes via Fix ...

CVE-2013-0459

Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-3317

IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment JRE files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300...

Buffer overflow

IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment JRE files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300...

CVE-2012-4834

Directory traversal vulnerability in LayerLoader.jsp in the theme component in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF19 and 8.0 before CF03 allows remote attackers to read arbitrary files via a crafted URI...