CVE-2006-6637

The CVE-2006-6637 entry applies to IBM WebSphere Application Server (WAS) 6.0.x prior to 6.0.2.17, where enabling fileServingEnabled via ibm-web-ext.xmi and enabling servlet caching allows remote attackers to obtain JSP source code and other sensitive information through specific requests. Connec...

CVE-2006-6637: Exposure of Sensitive Information to an Unauthorized Actor

The Servlet Engine and Web Container in IBM WebSphere Application Server WAS before 6.0.2.17, when ibm-web-ext.xmi sets fileServingEnabled to true and servlet caching is enabled, allows remote attackers to obtain JSP source code and other sensitive information via "specific requests."...

CVE-2006-6636: Undefined Security Weakness

Unspecified vulnerability in the Utility Classes for IBM WebSphere Application Server WAS before 5.1.1.13 and 6.x before 6.0.2.17 has unknown impact and attack vectors...

Multiple IBM Websphere security vulnerabilities

JSP pages source code access...

[SA23414] IBM WebSphere Application Server Multiple Vulnerabilities

TITLE: IBM WebSphere Application Server Multiple Vulnerabilities SECUNIA ADVISORY ID: SA23414 VERIFY ADVISORY: http://secunia.com/advisories/23414/ CRITICAL: Moderately critical IMPACT: Unknown, Exposure of system information, Exposure of sensitive information WHERE: From remote SOFTWARE: IBM...

IBM WebSphere Host On-Demand绕过认证访问管理功能漏洞

IBM WebSphere Host On-Demand是一款允许从启用Java的Web浏览器访问主机应用和数据的解决方案。 IBM WebSphere Host On-Demand用户访问验证处理存在设计问题，远程攻击者可利用漏洞绕过访问验证非获得对管理功能的访问。 IBM WebSphere Host On-Demand用于验证用户的applet一般位于https://server/hod/HODAdmin.html 。访问这个页面并运行applet，Web浏览器会显示如下URL：...

CVE-2006-6537

IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html...

CVE-2006-6537

IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html...

CVE-2006-6537: Undefined Security Weakness

IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html...

ibmwebsphere-bypass.txt

SUMMARY Vulnerability found in: IBM WebSphere Host On-Demand HOD Type: Unauthorized, remote access to HOD administration pages Applies to: Version 6.0, 7.0, 8.0, and 9.0 possibly 10.0 Severity Level: High Exploit Difficulty: Very Low Initial Vendor Notification: approximately 11/3/2006 Discovered...

IBM WebSphere Host On-Demand绕过认证执行管理功能漏洞

IBM WebSphere Host On-Demand（HOD）允许从启用了Java的Web浏览器访问主机应用和数据。 HOD在用户认证的实现上存在设计问题，远程攻击者可能利用此漏洞轻易绕过访问验证非授权操作管理功能。 HOD中用于处理用户认证的applet通常位于https://server/hod/HODAdmin.html...

IBM WebSphere Host On-Demand authentication bypass

Some URLs allow access without authentication...

IBM WebSphere Application Server 6.0.2.13之前版本多个漏洞

IBM Websphere Application Server是功能强大的WEB应用服务程序。 IBM Websphere Application Server 6.0.2.13之前版本存在多个安全问题，远程攻击者可以利用漏洞获得敏感信息或进行拒绝服务等攻击。 IBM Websphere Application Server 6.0.2 .9 IBM Websphere Application Server 6.0.2 .7 IBM Websphere Application Server 6.0.2 .5 IBM Websphere Application Server 6.0.2 ...

CVE-2006-6135

Multiple unspecified vulnerabilities in IBM WebSphere Application Server 6.1.0 before Fix Pack 3 6.1.0.3 have unknown impact and attack vectors, related to 1 a "Potential security vulnerability" PK29725 and 2 "Potential security exposure" PK30831...

CVE-2006-6135

Multiple unspecified vulnerabilities in IBM WebSphere Application Server 6.1.0 before Fix Pack 3 6.1.0.3 have unknown impact and attack vectors, related to 1 a "Potential security vulnerability" PK29725 and 2 "Potential security exposure" PK30831...

CVE-2006-6136: Undefined Security Weakness

IBM WebSphere Application Server 6.1.0 before Fix Pack 3 6.1.0.3 does not perform EAL4 authentication checks at the proper time during "registering of response operation," which has unknown impact and attack vectors...

CVE-2006-6135: Undefined Security Weakness

Multiple unspecified vulnerabilities in IBM WebSphere Application Server 6.1.0 before Fix Pack 3 6.1.0.3 have unknown impact and attack vectors, related to 1 a "Potential security vulnerability" PK29725 and 2 "Potential security exposure" PK30831...

IBM WebSphere Application Server '%20' Request Source Disclosure

It is possible to make the remote web server disclose the source code of its JSP pages by requesting the .jsp file with a '%20' appended to the request. An attacker may use this flaw to get the source code of your CGIs and possibly to obtain passwords and other relevant information about this hos...

IBM Websphere 6.0 - Faultactor Cross-Site Scripting

IBM Websphere 6.0 - Faultactor Cross-Site Scripting source: https://www.securityfocus.com/bid/21018/info IBM WebSphere is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code...

IBM Websphere 6.0 - 'Faultactor' Cross-Site Scripting

source: https://www.securityfocus.com/bid/21018/info IBM WebSphere is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the...