CVE-2016-9706

IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all...

CVE-2016-9706

IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all...

Design/Logic Flaw

IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...

CVE-2016-9010

CVE-2016-9010 affects IBM WebSphere Message Broker and IBM Integration Bus (including V8, V9, V10 branches). The vulnerability is a clickjacking flaw caused by not setting the X-Frame-OPTIONS header in the Web UI, enabling a remote attacker to hijack a user’s click actions by luring them to a mal...

CVE-2016-9010

IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...

CVE-2016-9706

CVE-2016-9706 affects IBM Integration Bus (9.0/10.0) and WebSphere Message Broker SOAP FLOWS. An XML External Entity (XXE) processing flaw can lead to denial of service and potential exposure of sensitive data. Affected products/versions per IBM bulletin: IBM Integration Bus V10 (fix pack 10.0.0....

CVE-2016-6080

The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker...

CVE-2016-6080

The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker...

CVE-2016-0394

IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files...

CVE-2016-0394

IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files...

CVE-2016-6080

CVE-2016-6080 affects WebSphere Message Broker (WebAdmin) on WebSphere Message Broker v8. The vulnerability allows directory listings via the WebAdmin context, potentially disclosing sensitive information. IBM’s security bulletin confirms the issue and provides a remediation: apply APAR IT16698 i...

CVE-2016-6080

The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker...

CVE-2016-0394

Summary: CVE-2016-0394 affects IBM Integration Bus and WebSphere Message Broker. The root cause is incorrect permissions set for an object on Unix platforms, which could allow a local attacker to manipulate certain files. Affected products/versions: IBM Integration Bus V9 and WebSphere Message Br...

[SECURITY] Fedora 25 Update: qpid-java-6.0.4-5.fc25

Qpid Java offers an AMQP-fluent implementation of JMS and a message broker written in Java that stores, routes, and forwards messages using AMQP...

Deserialization Of Pickled Message

Celery is vulnerable to deserialization attacks. The default configuration in Celery allows for the deserialization of pickled messages, even if it is configured to send messages in the JSON format. This is because the acceptcontent setting by default is set to: app.conf.acceptcontent = 'json',...

IBM Integration Bus and WebSphere Message Broker Local Security Bypass Vulnerability

BM Integration Bus and WebSphere Message Broker are both enterprise service bus ESB products from IBM, USA. The products provide connectivity and common data transformations for Service Oriented Architecture SOA environments and non-SOA environments. A local security bypass vulnerability exists i...

IBM WebSphere Message Broker Information Disclosure Vulnerability (CNVD-2016-11964)

IBM WebSphere Message Broker now known as IBM Integration Bus is an enterprise service bus ESB product from IBM, USA. The product provides connectivity and common data transformations for Service Oriented Architecture SOA environments and non-SOA environments. A security vulnerability exists in...

The vulnerability of the WebSphere Application Server software allows a malicious attacker to compromise the accessibility of protected information.

The vulnerability in the XML4J processor of IBM WebSphere Message Broker and IBM Integration Bus allows malicious actors to trigger a service failure excessive memory consumption by using a specially crafted XML document that causes a large number of entities to be processed excessively...

CVE-2016-2961

The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows remote attackers to obtain sensitive Tomcat version information by sending a malformed POST request and then reading the Java stack trace...

CVE-2016-2961

The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows remote attackers to obtain sensitive Tomcat version information by sending a malformed POST request and then reading the Java stack trace...