Code injection

Multiple unspecified vulnerabilities in the administrative console in IBM WebSphere Application Server WAS 7.0.x before 7.0.0.9 on z/OS have unknown impact and attack vectors...

CVE-2010-1182

Multiple unspecified vulnerabilities in the administrative console in IBM WebSphere Application Server WAS 7.0.x before 7.0.0.9 on z/OS have unknown impact and attack vectors...

IBM Multiple Products login.php Query String XSS

The version of IBM WebSphere Portal / IBM Lotus Web Content Management running on the remote host has a cross-site scripting vulnerability. The query string passed to login.php is not properly sanitized. A remote attacker could exploit this by tricking a user into requesting a maliciously crafted...

Cross site scripting

Cross-site scripting XSS vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management WCM, and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr...

Open redirect

Open redirect vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management WCM, and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0...

IBM WebSphere Portal Server & Lotus WCM XSS Vulnerability

Exploit for unknown platform in category web applications ========================================================= IBM WebSphere Portal Server & Lotus WCM XSS Vulnerability ========================================================= =========== I. Overview =========== During a penetration test...

IBM Websphere Portal Cross Site Scripting

Hacktics Research Group Security Advisory http://www.hacktics.com/view=Resources%7CAdvisory By Oren Hafif, Hacktics. 24-Feb-2010 =========== I. Overview =========== During a penetration test performed by Hacktics' experts, certain vulnerabilities were identified in an IBM Websphere Portal Server...

Cross site scripting

Cross-site scripting XSS vulnerability in the Portlet Palette in IBM WebSphere Portal 6.0.1.5 wp601500801 allows remote attackers to inject arbitrary web script or HTML via the search field...

CVE-2010-0704

Cross-site scripting XSS vulnerability in the Portlet Palette in IBM WebSphere Portal 6.0.1.5 wp601500801 allows remote attackers to inject arbitrary web script or HTML via the search field...

CVE-2010-0704

Cross-site scripting XSS vulnerability in the Portlet Palette in IBM WebSphere Portal 6.0.1.5 wp601500801 allows remote attackers to inject arbitrary web script or HTML via the search field...

IBM Websphere Portal 6.0.1.5 Build wp6015 - Portlet Palette Search HTML Injection

IBM Websphere Portal 6.0.1.5 Build wp6015 - Portlet Palette Search HTML Injection source: https://www.securityfocus.com/bid/38360/info IBM WebSphere Portal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. An authenticated attacker may leverage...

IBM WebSphere应用服务器Requires SSL选项绕过安全限制漏洞

BUGTRAQ ID: 38122 IBM Websphere应用服务器以Java和Servlet引擎为基础，支持多种HTTP服务，可帮助用户完成从开发、发布到维护交互式的动态网站的所有工作。 Websphere应用服务器在处理配置数据时存在错误，可能导致无法检测和应用单次登录的Requires SSL选项，远程用户可以绕过限制获得非授权访问。 IBM Websphere Application Server 7.0.0.0 - 7.0.0.8 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2009-2752

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...

CVE-2009-2751

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

Design/Logic Flaw

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

Information disclosure

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...

CVE-2009-2752

IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...

CVE-2009-2751

IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors...

WebSphere 6.1 跨站脚本漏洞

漏洞信息： WebSphere 是 IBM 的软件平台。它包含了编写、运行和监视全天候的工业强度的随需应变 Web 应用程序和跨平台、跨产品解决方案所需要的整个中间件基础设施，如服务器、服务和工具。WebSphere 提供了可靠、灵活和健壮的软件。 IBM WebSphere Application Server WAS的UDDI用户控制台的uddigui/navigateTree.do中存在多个跨站脚本攻击漏洞。 远程攻击者可以借助1 keyField, 2 nameField, 3 valueField, 和 4 frameReturn参数，注入任意web脚本或HTML。 漏洞影响：...

xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...