CVE-2016-0283

CVE-2016-0283 affects IBM WebSphere Application Server Liberty Profile 8.5.5 before 8.5.5.9. The OpenID Connect (OIDC) client web application is vulnerable to cross-site scripting (XSS) via a crafted URL, enabling a remote attacker to inject web script or HTML in the victim’s browser. Impact per ...

CVE-2015-5004

CVE-2015-5004 affects IBM WebSphere Application Server Edge Component Caching Proxy. The vulnerability could allow a remote authenticated attacker to obtain sensitive information due to improper encryption. Affected are IBM WebSphere Application Server versions 8.0 (pre-8.0.0.12) and 8.5 (pre-8.5...

CVE-2015-2017

CVE-2015-2017 is an HTTP response-splitting/CRLF injection vulnerability in IBM WebSphere Application Server. Affected are WAS 6.1 (up to 6.1.0.47), 7.0 (before 7.0.0.39), 8.0 (before 8.0.0.12), and 8.5 (before 8.5.5.8). Exploitation could allow remote attackers to inject headers and perform resp...

CVE-2015-1936

CVE-2015-1936 concerns IBM WebSphere Application Server Administrative Console session hijacking when Security is disabled. A remote authenticated attacker could exploit this to hijack another user’s session via the JSESSIONID parameter. Affected products/versions from the sources include WAS 8.0...

CVE-2015-0175

CVE-2015-0175 affects IBM WebSphere Application Server Liberty Profile before 8.5.5.5. Root cause: incorrect handling of authData elements, allowing remote authenticated users to gain privileges via unspecified vectors. Impact and remediation are documented: apply Fix Pack/Interim Fix for WAS Lib...

CVE-2014-3021

IBM WebSphere Application Server WAS 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properly handle HTTP headers, which allows remote attackers to obtain sensitive cookie and authentication data via an unspecified HTTP method...

CVE-2014-4767

CVE-2014-4767 affects IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.3. A flaw in using the Liberty Repository for feature installation lets remote authenticated users execute arbitrary code via unspecified vectors. Impact is arbitrary code execution on affected Liberty deplo...

CVE-2014-3070

The CVE-2014-3070 case affects IBM WebSphere Application Server where the addFileRegistryAccount (VMM SPI Admin Task) can bypass access restrictions due to improper account creation. Affected products/versions: WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3. IBM bulletins document remediation...

CVE-2014-3083

CVE-2014-3083 concerns IBM WebSphere Application Server information disclosure via failure to restrict access to resources within web applications. Connected IBM bulletins show affected products/versions and explicit fixes: for WAS 7.x, remediation requires Fix Pack 35 (7.0.0.35) or later; for WA...

balitbang cms 3.3 - Multiple Vulnerabilities

No description provided by source. !===========================================================================! CMS Balitbang Edit File Vulnerability Author : Xr0b0t [email protected] Homepage : www.indonesiancoder.com | xrobot.mobi | mc-crew.net | exploit-id.com Date : 18 Mart, 2010 Tested on...

CVE-2014-0964

CVE-2014-0964 affects IBM WebSphere Application Server 6.1.0.0–6.1.0.47 and 6.0.2.0–6.0.2.43, where remote TLS traffic crafted to exploit CVE-2014-0160 can cause denial of service. The vulnerability stems from the Heartbeat handling used by OpenSSL, but the connected sources do not provide a vend...

CVE-2014-0896

CVE-2014-0896 affects IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.2. The vulnerability allows a remote attacker to obtain sensitive information via a crafted request. Remediation per the connected bulletin is to upgrade to 8.5.5.2 or later (Liberty Profile). The connected ...

CVE-2014-0857

CVE-2014-0857 affects IBM WebSphere Application Server (WAS) Administrative Console. Affected versions: WAS 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2. Description: remote authenticated users can obtain sensitive information via a crafted request due to improper handling of requests in the Admin...

CVE-2014-0859

CVE-2014-0859 affects IBM WebSphere Application Server where the web server plugin configured to retry failed POST requests may cause a denial of service (daemon crash). Affected: WAS 7.x up to 7.0.0.33, WAS 8.x up to 8.0.0.9, WAS 8.5.x up to 8.5.5.2. Remediation: apply the corresponding Fix Pack...

CVE-2013-5414

CVE-2013-5414 affects IBM WebSphere Application Server (versions 8.5, 8.0, 7) where the migration from 6.1+ can leave adminsecmanager users with elevated privileges due to incorrect assignment of admin/adminsecmanager roles. Consequence: existing users could gain privileges post-migration. remedi...

CVE-2013-4006

CVE-2013-4006 affects IBM WebSphere Application Server Liberty Profile 8.5 (before 8.5.5.1). The vulnerability is due to insecure permissions on files created by the Liberty server, enabling a local attacker to obtain sensitive information via normal filesystem operations. A fix is to apply IBM F...

CVE-2013-3029

CVE-2013-3029: IBM WebSphere Application Server Administrative Console CSRF vulnerability allowing a remote attacker to leverage authentication for requests embedding XSS. Affected versions include WAS 6.1 (up to 6.1.0.46/47), 7.0 (up to 7.0.0.31), 8.0 (up to 8.0.0.7), and 8.5 (up to 8.5.5.1). Re...

CVE-2013-2967

CVE-2013-2967 is an XSS in the WebSphere Application Server Admin Console caused by improper input validation. Affected products include WAS v6.1, 7.0, 8.0, and 8.5. Remediation is to apply the APAR PM78614-containing fixes; specific fix-pack guidance from IBM notes: for 8.5.x (8.5.0.2 and earlie...

CVE-2013-0543

CVE-2013-0543 affects IBM WebSphere Application Server (WAS) across 6.1 (pre-6.1.0.47), 7.0 (pre-7.0.0.29), 8.0 (pre-8.0.0.6), and 8.5 (pre-8.5.0.2) on Linux, Solaris, and HP-UX. Root cause: improper validation of a user via Local OS registries allows remote bypass of access controls. Remediation...

Design/Logic Flaw

IBM WebSphere Application Server WAS 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 on z/OS, in certain configurations involving Federated Repositories for IIOP connections and Optimized Local Adapters, does not perform CBIND checks, which allows local users ...