IBM InfoSphere Information Server 会话固定漏洞(CVE-2013-0507)

BUGTRAQ ID: 59815 CVECAN ID: CVE-2013-0507 IBM InfoSphere Information Server是信息集成平台。 IBM InfoSphere Information Server 8.1、8.5、8.7、9.1在通过身份验证后没有更新会话标识，这可导致会话固定攻击。通过冒充合法用户的会话，攻击者利用此漏洞可在未授权的情况下访问应用。 0 IBM InfoSphere Information Server 9.x IBM InfoSphere Information Server 8.x 厂商补丁： IBM ---...

CVE-2013-0688

Cross-site scripting XSS vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0684

SQL injection vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-0685

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

CVE-2013-0686

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in...

Code injection

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

Sql injection

SQL injection vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Xxe

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in...

CVE-2013-0685

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

CVE-2013-0684

CVE-2013-0684 is a SQL injection vulnerability in Invensys Wonderware Information Server (WIS) affecting WIS 4.0 SP1SP1, 4.5 Portal, and 5.0 Portal. The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors (CWE-89). Multiple sources confirm the affected products...

CVE-2013-0688

Cross-site scripting XSS vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0685

CVE-2013-0685 affects Invensys Wonderware Information Server (WIS): versions 4.0 SP1SP1, 4.5 Portal, and 5.0 Portal. The root cause is improper restriction of resource requests, allowing an attacker to perform resource exhaustion that could lead to remote code execution or a denial of service. Ex...

CVE-2013-0684

SQL injection vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-0688

CVE-2013-0688 (Wonderware Information Server): XSS in WIS 4.0 SP1, 4.5 Portal, and 5.0 Portal allows remote injection of script/HTML. Root cause: improper neutralization of input in web pages (CWE-79). Impact noted as potentially remote code execution, data disclosure, or session credential hijac...

CVE-2013-0502

Cross-site scripting XSS vulnerability in IBM InfoSphere Information Server 8.1, 8.5 through FP3, 8.7 through FP2, and 9.1 allows remote attackers to inject arbitrary web script or HTML via a malformed URL...

CVE-2012-5938

The installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and Linux sets incorrect permissions and ownerships for unspecified files, which allows local users to bypass intended access restrictions via standard filesystem operations...

Design/Logic Flaw

The installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and Linux sets incorrect permissions and ownerships for unspecified files, which allows local users to bypass intended access restrictions via standard filesystem operations...

CVE-2012-5938

The installation process in IBM InfoSphere Information Server 8.1, 8.5, 8.7, and 9.1 on UNIX and Linux sets incorrect permissions and ownerships for unspecified files, which allows local users to bypass intended access restrictions via standard filesystem operations...

CVE-2012-5938

The issue (CVE-2012-5938) affects IBM InfoSphere Information Server versions 8.1, 8.5, 8.7 and 9.1 on UNIX/Linux. During installation, files are created with insufficient permissions/ownership, allowing local users to bypass access restrictions via standard filesystem operations. The IBM Security...