CVE-2006-7166: Undefined Security Weakness

IBM WebSphere Application Server WAS 5.1.1.9 and earlier allows remote attackers to obtain JSP source code and other sensitive information via "a specific JSP URL."...

CVE-2006-7165: Undefined Security Weakness

IBM WebSphere Application Server WAS 5.0 through 5.1.1.0 allows remote attackers to obtain JSP source code and other sensitive information via certain "special URIs."...

IBM WebSphere应用服务器代码泄露漏洞

IBM Websphere Application Server是一款功能强大的WEB应用服务程序。 IBM Websphere Application Server处理畸形HTTP请求存在问题，远程攻击者可以利用此漏洞获得JSP代码信息。 在根据4种不同配置情况下，IBM Websphere Application Server可导致JSP源代码内容泄露： 1，从一个应用程序WAR服务JSP，当ibm.web.ext.xmi文件中fileServingEnabled设置为ture，存储在应用程序WAR目录下JSP文件可导致源代码泄露。...

CVE-2006-6636

Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server WAS before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors...

CVE-2006-6636

Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server WAS before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors...

CVE-2006-6637

The Servlet Engine and Web Container in IBM WebSphere Application Server WAS before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."...

CVE-2006-6637

The CVE-2006-6637 entry applies to IBM WebSphere Application Server (WAS) 6.0.x prior to 6.0.2.17, where enabling fileServingEnabled via ibm-web-ext.xmi and enabling servlet caching allows remote attackers to obtain JSP source code and other sensitive information through specific requests. Connec...

CVE-2006-6636: Undefined Security Weakness

Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server WAS before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors...

CVE-2006-6637: Exposure of Sensitive Information to an Unauthorized Actor

The Servlet Engine and Web Container in IBM WebSphere Application Server WAS before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."...

[SA23414] IBM WebSphere Application Server Multiple Vulnerabilities

TITLE: IBM WebSphere Application Server Multiple Vulnerabilities SECUNIA ADVISORY ID: SA23414 VERIFY ADVISORY: http://secunia.com/advisories/23414/ CRITICAL: Moderately critical IMPACT: Unknown, Exposure of system information, Exposure of sensitive information WHERE: From remote SOFTWARE: IBM...

Multiple IBM Websphere security vulnerabilities

JSP pages source code access...

IBM WebSphere Host On-Demand绕过认证访问管理功能漏洞

IBM WebSphere Host On-Demand是一款允许从启用Java的Web浏览器访问主机应用和数据的解决方案。 IBM WebSphere Host On-Demand用户访问验证处理存在设计问题，远程攻击者可利用漏洞绕过访问验证非获得对管理功能的访问。 IBM WebSphere Host On-Demand用于验证用户的applet一般位于https://server/hod/HODAdmin.html 。访问这个页面并运行applet，Web浏览器会显示如下URL：...

CVE-2006-6537

IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html...

CVE-2006-6537

IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html...

CVE-2006-6537: Undefined Security Weakness

IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html...

ibmwebsphere-bypass.txt

SUMMARY Vulnerability found in: IBM WebSphere Host On-Demand HOD Type: Unauthorized, remote access to HOD administration pages Applies to: Version 6.0, 7.0, 8.0, and 9.0 possibly 10.0 Severity Level: High Exploit Difficulty: Very Low Initial Vendor Notification: approximately 11/3/2006 Discovered...

IBM WebSphere Host On-Demand绕过认证执行管理功能漏洞

IBM WebSphere Host On-Demand（HOD）允许从启用了Java的Web浏览器访问主机应用和数据。 HOD在用户认证的实现上存在设计问题，远程攻击者可能利用此漏洞轻易绕过访问验证非授权操作管理功能。 HOD中用于处理用户认证的applet通常位于https://server/hod/HODAdmin.html...

IBM WebSphere Host On-Demand authentication bypass

Some URLs allow access without authentication...

IBM WebSphere Application Server 6.0.2.13之前版本多个漏洞

IBM Websphere Application Server是功能强大的WEB应用服务程序。 IBM Websphere Application Server 6.0.2.13之前版本存在多个安全问题，远程攻击者可以利用漏洞获得敏感信息或进行拒绝服务等攻击。 IBM Websphere Application Server 6.0.2 .9 IBM Websphere Application Server 6.0.2 .7 IBM Websphere Application Server 6.0.2 .5 IBM Websphere Application Server 6.0.2 ...

CVE-2006-6135

Multiple unspecified vulnerabilities in IBM WebSphere Application Server 6.1.0 before Fix Pack 3 6.1.0.3 have unknown impact and attack vectors, related to 1 a "Potential security vulnerability" PK29725 and 2 "Potential security exposure" PK30831...