PT-2013-5503

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 7.0.0 through 7.0.0.2 CF24 IBM WebSphere Portal versions 8.0.0 through 8.0.0.1 CF7 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML by leveragin...

PT-2013-5502

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions prior to 8.0.0.1 CF8 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML. This is due to incorrect integration with IBM Connections...

CVE-2013-5378: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 8.x before 8.0.0.1 CF8 allows remote authenticated users to inject arbitrary web script or HTML by leveraging incorrect IBM Connections integration...

CVE-2013-5379: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 7.x before 7.0.0.2 CF25 and 8.x before 8.0.0.1 CF8 allows remote authenticated users to inject arbitrary web script or HTML by leveraging improper tagging functionality...

JDK: XML4J xml entity expansion excessive memory use (XML)

The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service memory consumption via a crafted XML document that triggers expansion for many entities...

CVE-2013-5446

The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors...

CVE-2013-5428

IBM WebSphere DataPower XC10 appliances 2.5.0 do not require authentication for all administrative actions, which allows remote attackers to cause a denial of service via unspecified vectors...

Design/Logic Flaw

The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors...

CVE-2013-5446

The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors...

PT-2013-5538

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliances version 2.5.0 Description The issue allows remote attackers to cause a denial of service via unspecified vectors because the appliances do not require authentication for all administrative actions...

CVE-2013-5446: Undefined Security Weakness

The console on IBM WebSphere DataPower XC10 appliances 2.1.0 and 2.5.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors...

PT-2013-5544

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 appliances versions 2.1.0 through 2.5.0 Description The issue is related to the console on IBM WebSphere DataPower XC10 appliances, which does not properly process logoff actions. This has an unspecified impact and...

CVE-2013-5428: Undefined Security Weakness

IBM WebSphere DataPower XC10 appliances 2.5.0 do not require authentication for all administrative actions, which allows remote attackers to cause a denial of service via unspecified vectors...

Code injection

The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service memory consumption via a crafted XML document that triggers expansion for many entities...

CVE-2013-5372

The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service memory consumption via a crafted XML document that triggers expansion for many entities...

CVE-2013-5372: Undefined Security Weakness

The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service memory consumption via a crafted XML document that triggers expansion for many entities...

PT-2013-1041

Name of the Vulnerable Software and Affected Versions IBM WebSphere Message Broker versions 6.1 through 6.1.0.12 IBM WebSphere Message Broker versions 7.0 through 7.0.0.7 IBM WebSphere Message Broker versions 8.0 through 8.0.0.4 IBM Integration Bus versions 9.0 through 9.0.0.1 Description The iss...

CVE-2013-5394

The monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 allows remote authenticated users to conduct phishing attacks via unspecified vectors...

CVE-2013-5390

Cross-site scripting XSS vulnerability in the monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

The monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 does not properly process logoff actions, which has unspecified impact and remote attack vectors...