CVE-2013-5372

CVE-2013-5372 is a denial-of-service vulnerability in the XML4J XML parser used by IBM WebSphere Message Broker (6.1 before 6.1.0.12; 7.0 before 7.0.0.7; 8.0 before 8.0.0.4) and IBM Integration Bus 9.0 before 9.0.0.1. A crafted XML document triggers entity expansion, causing memory consumption. C...

CVE-2013-5372

The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service memory consumption via a crafted XML document that triggers expansion for many entities...

CVE-2013-0482

IBM WebSphere Application Server WAS 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a crafted SOAP message,...

Design/Logic Flaw

IBM WebSphere Application Server WAS 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a crafted SOAP message,...

CVE-2013-0482

IBM WebSphere Application Server WAS 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a crafted SOAP message,...

CVE-2013-0482

CVE-2013-0482 : IBM WebSphere Application Server (WAS) and WebSphere Message Broker are affected. The vulnerability lies in the WS‑Security runtime, enabling a remote attacker to spoof message signatures by sending a crafted SOAP message (Signature Wrap attack). Affected products/versions include...

CVE-2012-5952

IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2 does not validate Basic Authentication credentials before proceeding to WS-Addressing and WS-Security operations, which allows remote attackers to trigger transmission of unauthenticated messages via...

CVE-2012-5953

IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2, when the Parse Query Strings option is enabled on an HTTPInput node, allows remote attackers to cause a denial of service infinite loop via a crafted query string...

CVE-2013-0466

Cross-site scripting XSS vulnerability in IBM WebSphere Message Broker 7.0 before 7.0.0.6 and 8.0 before 8.0.0.2, when wsdl support is enabled on a SOAPInput node, allows remote attackers to inject arbitrary web script or HTML via a wsdl request that is not properly handled during construction of...

Authentication flaw

IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2 does not validate Basic Authentication credentials before proceeding to WS-Addressing and WS-Security operations, which allows remote attackers to trigger transmission of unauthenticated messages via...

Design/Logic Flaw

IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2, when the Parse Query Strings option is enabled on an HTTPInput node, allows remote attackers to cause a denial of service infinite loop via a crafted query string...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Message Broker 7.0 before 7.0.0.6 and 8.0 before 8.0.0.2, when wsdl support is enabled on a SOAPInput node, allows remote attackers to inject arbitrary web script or HTML via a wsdl request that is not properly handled during construction of...

CVE-2012-5953

IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2, when the Parse Query Strings option is enabled on an HTTPInput node, allows remote attackers to cause a denial of service infinite loop via a crafted query string...

CVE-2012-5952

CVE-2012-5952 affects IBM WebSphere Message Broker: 6.1 prior to 6.1.0.12, 7.0 prior to 7.0.0.6, and 8.0 prior to 8.0.0.2. The issue is that basic authentication credentials are not validated before proceeding to WS-Addressing and WS-Security operations, which can allow remote attackers to trigge...

CVE-2012-5952

IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2 does not validate Basic Authentication credentials before proceeding to WS-Addressing and WS-Security operations, which allows remote attackers to trigger transmission of unauthenticated messages via...

CVE-2013-0466

CVE-2013-0466 affects IBM WebSphere Message Broker (7.0 prior to 7.0.0.6 and 8.0 prior to 8.0.0.2) where wsdl support on a SOAPInput node can trigger cross-site scripting. The root cause is improper handling during construction of an error message, allowing remote script/HTML injection via a wsdl...

CVE-2012-5953

The CVE-2012-5953 entry concerns IBM WebSphere Message Broker: affected versions are 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2, where enabling the Parse Query Strings option on an HTTPInput node allows a remote attacker to cause a denial of service (infinite loop) via a craf...

CVE-2012-3317

IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment JRE files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300...

Buffer overflow

IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment JRE files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300...

CVE-2012-3317

IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment JRE files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300...