PT-2014-3961

Name of the Vulnerable Software and Affected Versions IBM WebSphere Commerce versions 6.0 Feature Pack 2 through Feature Pack 5 IBM WebSphere Commerce versions 7.0.0.0 through 7.0.0.8 IBM WebSphere Commerce versions 7.0 Feature Pack 1 through Feature Pack 7 Description The issue allows remote...

IBM WebSphere Portal Unspecified DoS (PI15692)

The version of IBM WebSphere Portal on the remote host is affected by an unspecified denial of service vulnerability that allows a remote attacker to crash the host by sending a specially crafted web request. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

IBM WebSphere Portal 8.x < 8.0.0.1 CF12 Multiple Vulnerabilities

The version of IBM WebSphere Portal on the remote host is affected by multiple vulnerabilities : - A denial of service vulnerability exists in the Apache Commons FileUpload library that allows an attacker to cause the application to enter an infinite loop. CVE-2014-0050 - An unspecified denial of...

IBM WebSphere Portal 'boot_config.jsp' XSS (PI16041)

The version of IBM WebSphere Portal on the remote host is affected by a cross-site scripting vulnerability in the 'bootconfig.jsp' script due to improper user input validation. An attacker could exploit this issue to execute code in the security context of a user's browser to steal authentication...

IBM WebSphere Portal 7.0.0.x < 7.0.0.2 CF28 Multiple Vulnerabilities

The version of IBM WebSphere Portal installed on the remote host is affected by multiple vulnerabilities : - An unspecified denial of service vulnerability exists that allows a remote attacker to crash the host by sending a specially crafted web request. CVE-2014-0949 - A cross-site scripting XSS...

IBM WebSphere Portal 'FilterForm.jsp' XSS (PI15690)

The version of IBM WebSphere Portal on the remote host is affected by a cross-site scripting vulnerability in the 'FilterForm.jsp' script due to improper user input validation. An attacker can exploit this issue to execute code in the security context of a user's browser to steal authentication...

IBM WebSphere Portal Unspecified JSP XSS (PI16040)

The version of IBM WebSphere Portal on the remote host is affected by an unspecified cross-site scripting vulnerability due to improper user input validation by a JSP script. An attacker can exploit this issue to execute code in the security context of a user's browser to steal authentication...

IBM WebSphere Portal Open Redirect Vulnerability (PI15689)

The version of IBM WebSphere Portal on the remote host is affected by an unspecified open redirect vulnerability. This issue allows an attacker to perform a phishing attack by enticing a user to click on a malicious URL. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

IBM WebSphere Portal Web Content Viewer Portlet Privilege Escalation (PI15723)

The version of IBM WebSphere Portal on the remote host is affected by a privilege escalation vulnerability in the Web Content Viewer portlet due to improper handling of JSP includes. A remote attacker is able to obtain sensitive information, cause a denial of service, or control the request...

CVE-2014-0951

Cross-site scripting XSS vulnerability in FilterForm.jsp in IBM WebSphere Portal 7.0 before 7.0.0.2 CF28 and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-0954

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 does not validate JSP includes, which allows remote attackers to obtain sensitive information, bypass intended request-dispatcher access restrictions, or cause a deni...

CVE-2014-0956

Cross-site scripting XSS vulnerability in googlemap.jsp in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-0959

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote authenticated users to cause a denial of service infinite loop via a login redirect...

CVE-2014-0949

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to cause a denial of service resource consumption and daemon crash via a crafted web request...

CVE-2014-0952

Cross-site scripting XSS vulnerability in bootconfig.jsp in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF28, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-0955

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 8.0 before 8.0.0.1 CF12, when Social Rendering in Connections integration is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-0958

Open redirect vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 8.0 before 8.0.0.1 CF12, when Social Rendering in Connections integration is enabled, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 allows remote authenticated users to cause a denial of service infinite loop via a login redirect...

Design/Logic Flaw

IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12 does not validate JSP includes, which allows remote attackers to obtain sensitive information, bypass intended request-dispatcher access restrictions, or cause a deni...