Cross Site Scripting (XSS) Vulnerability in IBM WebSphere Application Server

Title: Cross Site Scripting XSS Vulnerability in IBM WebSphere Application Server ProCheckUp Security Bulletin Description: IBM WebSphere Application Server is vulnerable to Cross Site Scripting through a 'faultfactor' tag in the 500 Internal Server Error page on port 8880 default SOAP port. Date...

IBMWAS-XSS.txt

Title: Cross Site Scripting XSS Vulnerability in IBM WebSphere Application Server ProCheckUp Security Bulletin Description: IBM WebSphere Application Server is vulnerable to Cross Site Scripting through a 'faultfactor' tag in the 500 Internal Server Error page on port 8880 default SOAP port. Date...

CVE-2006-5323

Unspecified vulnerability in IBM WebSphere Application Server before 6.1.0.2 has unspecified impact and attack vectors, related to a "possible security exposure," aka PK29360...

CVE-2006-5324

The Web Services Notification WSN security component of IBM WebSphere Application Server before 6.1.0.2 allows attackers to obtain unspecified access without supplying a username and password, aka PK28374...

CVE-2006-5323

Unspecified vulnerability in IBM WebSphere Application Server before 6.1.0.2 has unspecified impact and attack vectors, related to a "possible security exposure," aka PK29360...

CVE-2006-5324

The Web Services Notification WSN security component of IBM WebSphere Application Server before 6.1.0.2 allows attackers to obtain unspecified access without supplying a username and password, aka PK28374...

CVE-2006-5323: Undefined Security Weakness

Unspecified vulnerability in IBM WebSphere Application Server before 6.1.0.2 has unspecified impact and attack vectors, related to a "possible security exposure," aka PK29360...

CVE-2006-5324: Undefined Security Weakness

The Web Services Notification WSN security component of IBM WebSphere Application Server before 6.1.0.2 allows attackers to obtain unspecified access without supplying a username and password, aka PK28374...

CVE-2006-4222

Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.0.2.13 have unspecified vectors and impact, including 1 an "authority problem" in ThreadIdentitySupport as identified by PK25199, and "Potential security exposure" issues as identified by 2 PK22747, 3 PK24334, 4...

CVE-2006-4223

IBM WebSphere Application Server WAS before 6.0.2.13 allows context-dependent attackers to obtain sensitive information via unspecified vectors related to "JSP source code exposure" PK23475, which occurs when ibm-web-ext.xmi sets fileServingEnabled to true or ExtendedDocumentRoot is used to place...

CVE-2006-4223

CVE-2006-4223 affects IBM WebSphere Application Server (WAS) before version 6.0.2.13. The issue involves JSP source code exposure via context-dependent paths when ibm-web-ext.xmi sets fileServingEnabled to true or when ExtendedDocumentRoot places a JSP outside a WAR file. This allows an attacker ...

CVE-2006-4222: Undefined Security Weakness

Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.0.2.13 have unspecified vectors and impact, including 1 an "authority problem" in ThreadIdentitySupport as identified by PK25199, and "Potential security exposure" issues as identified by 2 PK22747, 3 PK24334, 4...

CVE-2006-4223: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS before 6.0.2.13 allows context-dependent attackers to obtain sensitive information via unspecified vectors related to "JSP source code exposure" PK23475, which occurs when ibm-web-ext.xmi sets fileServingEnabled to true or ExtendedDocumentRoot is used to place...

CVE-2006-4136

Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.1.0.1 have unspecified impact and attack vectors involving 1 "SOAP requests and responses", 2 mbean, 3 ThreadIdentitySupport, and possibly others...

CVE-2006-4137

IBM WebSphere Application Server before 6.1.0.1 allows attackers to obtain sensitive information via unspecified vectors related to 1 the log file, 2 "script generated syntax on wsadmin command line," and 3 traces...

CVE-2006-4136

Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.1.0.1 have unspecified impact and attack vectors involving 1 "SOAP requests and responses", 2 mbean, 3 ThreadIdentitySupport, and possibly others...

CVE-2006-4137: Undefined Security Weakness

IBM WebSphere Application Server before 6.1.0.1 allows attackers to obtain sensitive information via unspecified vectors related to 1 the log file, 2 "script generated syntax on wsadmin command line," and 3 traces...

CVE-2006-4136: Exposure of Sensitive Information to an Unauthorized Actor

Multiple unspecified vulnerabilities in IBM WebSphere Application Server before 6.1.0.1 have unspecified impact and attack vectors involving 1 "SOAP requests and responses", 2 mbean, 3 ThreadIdentitySupport, and possibly others...

CVE-2006-3232

Unspecified vulnerability in IBM WebSphere Application Server before 6.0.2.11 has unknown impact and attack vectors because the "UserNameToken cache was improperly used."...

CVE-2006-3231

Unspecified vulnerability in IBM WebSphere Application Server WAS before 6.0.2.11, when fileServingEnabled is true, allows remote attackers to obtain JSP source code and other sensitive information via "URIs with special characters."...