CVE-2010-1651

IBM WebSphere Application Server (WAS) is affected by CVE-2010-1651: when Basic authentication and SIP tracing are enabled, SIP trace logs contain the complete inbound/outbound SIP messages, allowing a local attacker to read sensitive information. Affected versions are WAS 6.1.x prior to 6.1.0.31...

CVE-2010-0769

IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 do not properly define wsadmin scripting J2CConnectionFactory objects, which allows local users to read a KeyRingPassword password from a cleartext field in resources.xml. This is a local infor...

Discloser 'more' Parameter SQL Injection Vulnerability

The host is running Discloser and is prone to SQL injection vulnerability. OpenVAS Vulnerability Test $Id: secpoddisclosersqlinjvuln.nasl 5394 2017-02-22 09:22:42Z teissa $ Discloser 'more' Parameter SQL Injection Vulnerability Authors: Antu Sanadi Copyright: Copyright c 2010 SecPod,...

CVE-2009-2742

IBM WebSphere Application Server 6.1 before 6.1.0.27 is affected by a cross-site scripting (XSS) vulnerability in the Eclipse Help component. The root cause is insufficient validation of input in Eclipse Help, allowing remote attackers to inject arbitrary script/HTML via unspecified input. Affect...

CVE-2009-2089

CVE-2009-2089 affects IBM WebSphere Application Server: the Migration component in WAS 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 can reveal sensitive information by readers of a Migration Trace file when tracing during a 6.1→7.0 migration. The issue enables remote authenticated users to obtain p...

Design/Logic Flaw

IBM WebSphere Application Server WAS 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remot...

CVE-2009-0903

The CVE affects IBM WebSphere Application Server (WAS) 7.0 prior to 7.0.0.3 and the Web Services Feature Pack for WAS 6.1 prior to 6.1.0.25. When a WS-Security policy is set at the operation level, inbound requests that lack a SOAPAction or WS-Addressing Action are not handled correctly, enabling...

CVE-2009-1898

CVE-2009-1898 affects IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35. The issue is that the secure login page in the Administrative Console does not redirect HTTP requests to HTTPS, enabling a remote attacker to read session contents by sniffing network traffic. Connected sources co...

CVE-2009-1174

IBM WebSphere Application Server shows a vulnerability in its Web Services Security XML digital-signature handling. Affected products/versions: WebSphere Application Server 6.0.2 prior to 6.0.2.35 and 7.0 prior to 7.0.0.3. Root cause: an unspecified security problem in the XML digital-signature s...

CVE-2009-0506

CVE-2009-0506 affects IBM WebSphere Application Server 5.1 and 6.0.2 before 6.0.2.33 on z/OS when CSIv2 Identity Assertion is enabled and EJB interaction occurs between a WAS 6.1 instance and a pre-6.1 instance. The vulnerability allows local users to cause an unknown impact via two vectors: (1) ...

CVE-2008-4283

CVE-2008-4283 describes a CRLF injection vulnerability in the WebContainer component of IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.1.x versions. The issue allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via unspecified vectors. Accor...

CVE-2009-0435

IBM WebSphere Application Server 6.1.x on AIX 5.3 is affected by a denial-of-service vulnerability in the IBM JMS AIO/libibmaio library (aio_getioev2 and getEvent). The issue exists in WAS 6.1.x before 6.1.0.17 and can cause a daemon crash. Remediation: upgrade to WAS 6.1.0.17 or later Fix Pack t...

CVE-2009-0433

CVE-2009-0433 affects IBM WebSphere Application Server (WAS) 5.1.x before 5.1.1.19, 6.0.x before 6.0.2.29, and 6.1.x before 6.1.0.19. The issue arises when the Web Server plug-in content buffering is enabled, due to mishandling of client read failures. This can cause a denial of service (daemon c...

CVE-2009-0437

CVE-2009-0437 affects the IBM WebSphere Application Server (WAS) 6.0.2 on Windows when WAS is registered as a Windows service. The vulnerability enables local users to obtain sensitive information by reading the logs/instconfigifwas6.log. The provided documents do not include exploitation details...

CVE-2009-0391

Technical details about CVE-2009-0391 (affected WAS component, root cause, exploit vectors or fixes) are not publicly available in the provided documents. Monitor for updates.

CVE-2008-5411

CVE-2008-5411 affects IBM WebSphere Application Server (WAS) 7 before 7.0.0.1, where SSL traffic is sent over unsecured TCP, enabling remote attackers to sniff and obtain sensitive information. Root cause: SSL data transmitted without proper protocol protection. Impact: confidentiality compromise...

CVE-2008-5414

IBM WebSphere Application Server 7.0 before Fix Pack 1 (i.e., before 7.0.0.1) is affected by a vulnerability in the Feature Pack for Web Services Web Services Security component related to the userNameToken, potentially enabling information disclosure. Connective sources (NVD/NVD-derived content ...

CVE-2008-5413

CVE-2008-5413 affects IBM WebSphere Application Server (WAS): PerfServlet in the PMI/Performance Tools component allows a local attacker to read sensitive information from logs (systemout.log) and ffdc files. Affected line in the public description specifies WAS 7 before 7.0.0.1 (and related note...

CVE-2008-5412

IBM WebSphere Application Server 7 (Windows) is affected by CVE-2008-5412/CVE-2009-0438, where WAS 7 before 7.0.0.1 allows remote attackers to bypass authorization and read sensitive data from JSPs via a crafted request. The issue is described as unspecified in the 2008 entry, with later sources ...

CVE-2008-4679

CVE-2008-4679 affects IBM WebSphere Application Server: Web Services Security in WAS 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19. When Certificate Store Collections uses CRLs, the code path does not call setRevocationEnabled on PKIXBuilderParameters, preventing revocation checks for X.509 certi...