5712 matches found
Crlf injection
CRLF injection vulnerability in IBM WebSphere Application Server WAS before 6.0.2.19 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a single CRLF sequence in a context that is not a valid multi-line header...
CVE-2006-7164
SimpleFileServlet in IBM WebSphere Application Server 5.0.1 through 5.0.2.7 on Linux and UNIX does not block certain invalid URIs and does not issue a security challenge, which allows remote attackers to read secure files and obtain sensitive information via certain requests...
CVE-2006-7164
CVE-2006-7164 concerns IBM WebSphere Application Server 5.0.1–5.0.2.7 on Linux/UNIX. The issue is in SimpleFileServlet, which does not block certain invalid URIs and does not issue a security challenge, enabling remote attackers to read secure files and obtain sensitive information via certain re...
CVE-2006-7164
SimpleFileServlet in IBM WebSphere Application Server 5.0.1 through 5.0.2.7 on Linux and UNIX does not block certain invalid URIs and does not issue a security challenge, which allows remote attackers to read secure files and obtain sensitive information via certain requests...
CVE-2006-7165
IBM WebSphere Application Server WAS 5.0 through 5.1.1.0 allows remote attackers to obtain JSP source code and other sensitive information via certain "special URIs."...
CVE-2006-7166
IBM WebSphere Application Server WAS 5.1.1.9 and earlier allows remote attackers to obtain JSP source code and other sensitive information via "a specific JSP URL."...
CVE-2005-4833
IBM WebSphere Application Server WAS 6.0 before 20050201, when serving pages in an Application WAR or an Extended Document Root, allows remote attackers to obtain the JSP source code and other sensitive information via "a specific JSP URL," related to lack of normalization of the URL format...
IBM WebSphere应用服务器代码泄露漏洞
IBM Websphere Application Server是一款功能强大的WEB应用服务程序。 IBM Websphere Application Server处理畸形HTTP请求存在问题，远程攻击者可以利用此漏洞获得JSP代码信息。 在根据4种不同配置情况下，IBM Websphere Application Server可导致JSP源代码内容泄露： 1，从一个应用程序WAR服务JSP，当ibm.web.ext.xmi文件中fileServingEnabled设置为ture，存储在应用程序WAR目录下JSP文件可导致源代码泄露。...
CVE-2006-6636
Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server WAS before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors...
CVE-2006-6637
The Servlet Engine and Web Container in IBM WebSphere Application Server WAS before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."...
CVE-2006-6636
Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server WAS before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors...
CVE-2006-6637
The CVE-2006-6637 entry applies to IBM WebSphere Application Server (WAS) 6.0.x prior to 6.0.2.17, where enabling fileServingEnabled via ibm-web-ext.xmi and enabling servlet caching allows remote attackers to obtain JSP source code and other sensitive information through specific requests. Connec...
[SA23414] IBM WebSphere Application Server Multiple Vulnerabilities
TITLE: IBM WebSphere Application Server Multiple Vulnerabilities SECUNIA ADVISORY ID: SA23414 VERIFY ADVISORY: http://secunia.com/advisories/23414/ CRITICAL: Moderately critical IMPACT: Unknown, Exposure of system information, Exposure of sensitive information WHERE: From remote SOFTWARE: IBM...
Multiple IBM Websphere security vulnerabilities
JSP pages source code access...
IBM WebSphere Host On-Demand绕过认证访问管理功能漏洞
IBM WebSphere Host On-Demand是一款允许从启用Java的Web浏览器访问主机应用和数据的解决方案。 IBM WebSphere Host On-Demand用户访问验证处理存在设计问题，远程攻击者可利用漏洞绕过访问验证非获得对管理功能的访问。 IBM WebSphere Host On-Demand用于验证用户的applet一般位于https://server/hod/HODAdmin.html 。访问这个页面并运行applet，Web浏览器会显示如下URL：...
CVE-2006-6537
IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html...
CVE-2006-6537
IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html...
IBM WebSphere Host On-Demand绕过认证执行管理功能漏洞
IBM WebSphere Host On-Demand（HOD）允许从启用了Java的Web浏览器访问主机应用和数据。 HOD在用户认证的实现上存在设计问题，远程攻击者可能利用此漏洞轻易绕过访问验证非授权操作管理功能。 HOD中用于处理用户认证的applet通常位于https://server/hod/HODAdmin.html...
ibmwebsphere-bypass.txt
SUMMARY Vulnerability found in: IBM WebSphere Host On-Demand HOD Type: Unauthorized, remote access to HOD administration pages Applies to: Version 6.0, 7.0, 8.0, and 9.0 possibly 10.0 Severity Level: High Exploit Difficulty: Very Low Initial Vendor Notification: approximately 11/3/2006 Discovered...