Directory traversal

Directory traversal vulnerability in LayerLoader.jsp in the theme component in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF19 and 8.0 before CF03 allows remote attackers to read arbitrary files via a crafted URI...

CVE-2012-4834

IBM WebSphere Portal versions 7.0.0.1/7.0.0.2 before CF19 and 8.0 before CF03 are affected by CVE-2012-4834 via the theme component’s LayerLoader.jsp (Dojo module). An attacker can read arbitrary files by supplying a crafted path/URI parameter, due to inadequate validation in the Dojo layerLoader...

CVE-2012-4834

Directory traversal vulnerability in LayerLoader.jsp in the theme component in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF19 and 8.0 before CF03 allows remote attackers to read arbitrary files via a crafted URI...

IBM WebSphere MQ 7.0 / 7.1 / 7.5 Global Security Toolkit Vulnerabilities

The version of IBM WebSphere MQ server is version 7.0 without Fix Pack 7.0.1.9, 7.1 without Fix Pack 7.1.0.2 or 7.5 without Fix Pack 7.5.0.1. It is, therefore, affected by the following vulnerabilities : - A flaw exists in Global Security Kit GSkit due to a failure to properly validate data when...

IBM WebSphere MQ 7.1 / 7.5 Multiple Vulnerabilities

The version of IBM WebSphere MQ server is version 7.1 without Fix Pack 7.1.0.2 or 7.5 without Fix Pack 7.5.0.1. It is, therefore, affected by the following vulnerabilities : - A flaw exists in Global Security Kit GSkit due to a failure to properly validate data when the 'protection mechanism' is...

CVE-2012-5756

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by 1 sniffing the...

Code injection

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by 1 sniffing the...

CVE-2012-5756

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, has a single secret key that is shared across different customers' installations, which allows remote attackers to spoof a container server by 1 sniffing the...

IBM WebSphere Application Server 8.5 < Fix Pack 1 Multiple Vulnerabilities

IBM WebSphere Application Server 8.5 before Fix Pack 1 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities : - An input validation error exists related to the 'Eclipse Help System' that can allow arbitrary redirect responses to HTTP...

IBM WebSphere MQ 6.x < 6.0.2.9 / 7.x < 7.0.1.1 'userid' and 'password' Information Disclosure

The IBM WebSphere MQ server installed on the remote Windows host is version 6.x prior to 6.0.2.9 or version 7.x prior to 7.0.1.1. It is, therefore, affected by a security weakness where usernames and passwords are sent as cleartext in parameter fields, thus allowing a remote attacker to obtain...

CVE-2012-4853

Cross-site request forgery CSRF vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information disclosure...

CVE-2012-4851

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information disclosure...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI...

Code injection

IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1, when JAX-RS is used, does not properly validate requests, which allows remote attackers to gain privileges via unspecified vectors...

CVE-2012-4850

IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1, when JAX-RS is used, does not properly validate requests, which allows remote attackers to gain privileges via unspecified vectors...

CVE-2012-4853

CVE-2012-4853 describes a cross-site request forgery (CSRF) in IBM WebSphere Application Server. Affected versions are 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1. The vulnerability could allow an attacker to hijack the authentication of a user for request...

CVE-2012-4851

CVE-2012-4851 affects IBM WebSphere Application Server Liberty Profile (8.5) with versions before 8.5.0.1. The issue is a cross-site scripting (XSS) vulnerability that lets remote attackers inject arbitrary web script or HTML via a crafted URI. The related connected IBM bulletin entries describe ...

CVE-2012-4851

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI...

IBM WebSphere MQ队列管理器大型消息拒绝服务漏洞

BUGTRAQ ID: 56471 IBM WebSphere MQ用于在企业中提供消息传输服务。 IBM WebSphere MQ 7.1在执行下列条目时，意外中断并生成一个FDC文件，在实现上存在拒绝服务漏洞，成功利用后可允许攻击者造成应用崩溃。 PIDS :- 5724H7220 LVLS :- 7.1.0.0 Product Long Name :- WebSphere MQ for Windows Probe Id :- XC130031 Application Name :- MQM Component :- xehExceptionHandler SCCS Info :-...