PT-2013-4783

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.0 before 8.0.0.7 IBM WebSphere Application Server versions 8.5 before 8.5.5.1 Description A cross-site scripting XSS issue exists in the Administrative console of IBM WebSphere Application Server,...

PT-2013-4067

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 before 6.1.0.47 IBM WebSphere Application Server versions 7.0 before 7.0.0.29 IBM WebSphere Application Server versions 8.0 before 8.0.0.7 IBM WebSphere Application Server versions 8.5 before 8.5.5...

PT-2013-4097

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 6.1 through 8.0 Description The issue allows remote attackers to access the user directory via a crafted request for a servlet. This is related to the setting serveServletsByClassnameEnabled. Recommendations For I...

CVE-2013-4005: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified fields...

PT-2013-4784

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 before 6.1.0.47 IBM WebSphere Application Server versions 7.0 before 7.0.0.31 IBM WebSphere Application Server versions 8.0 before 8.0.0.7 IBM WebSphere Application Server versions 8.5 before 8.5.5...

CVE-2013-2976: Exposure of Sensitive Information to an Unauthorized Actor

The Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0 does not properly perform caching, which allows local users to obtain sensitive information via unspecified vectors...

CVE-2013-3016: Undefined Security Weakness

IBM WebSphere Portal 6.1, 7.0, and 8.0 allows remote attackers to access the user directory via a crafted request for a servlet, related to the serveServletsByClassnameEnabled setting...

CVE-2013-3029: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.31, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert...

CVE-2013-0597: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server WAS 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0, when OAuth is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

PT-2013-4071

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 before 6.1.0.47 IBM WebSphere Application Server versions 7.0 before 7.0.0.29 IBM WebSphere Application Server versions 8.0 before 8.0.0.7 IBM WebSphere Application Server versions 8.5 before 8.5.5...

PT-2013-2451

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 7.0.0.28 IBM WebSphere Application Server versions 8.0 through 8.0.0.6 IBM WebSphere Application Server versions 8.5 through 8.5.4 Description A cross-site scripting XSS issue exists when...

PT-2013-4103

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 6.1 before 6.1.0.47 IBM WebSphere Application Server WAS versions 7.0 before 7.0.0.31 IBM WebSphere Application Server WAS versions 8.0 before 8.0.0.7 IBM WebSphere Application Server WAS versions...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IBM WebSphere Portal before 8.0.0.1 CF07 allow remote attackers to inject arbitrary web script or HTML via vectors involving the 1 Portal, 2 Portal 7.0.0.2, 3 Portal 8.0, or 4 PortalWeb2 theme...

CVE-2013-0587

Multiple cross-site scripting XSS vulnerabilities in IBM WebSphere Portal before 8.0.0.1 CF07 allow remote attackers to inject arbitrary web script or HTML via vectors involving the 1 Portal, 2 Portal 7.0.0.2, 3 Portal 8.0, or 4 PortalWeb2 theme...

PT-2013-2445

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions prior to 8.0.0.1 CF07 Description The issue involves multiple cross-site scripting XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can be achieved through various vecto...

CVE-2013-0587: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in IBM WebSphere Portal before 8.0.0.1 CF07 allow remote attackers to inject arbitrary web script or HTML via vectors involving the 1 Portal, 2 Portal 7.0.0.2, 3 Portal 8.0, or 4 PortalWeb2 theme...

CVE-2013-2994

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors...

Design/Logic Flaw

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors...

CVE-2013-2993

IBM WebSphere Commerce 6.x up to 6.0.0.11 and 7.x up to 7.0.0.7 contains an authentication flaw in unspecified web services. The issue allows remote attackers to issue requests in the context of an arbitrary user’s active session via unknown vectors. Affected component is the authentication handl...

CVE-2013-2994: Improper Input Validation

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors...