CVE-2006-3288

Unspecified vulnerability in the TFTP server in Cisco Wireless Control System WCS for Linux and Windows before 3.251, when configured to use a directory path name that contains a space character, allows remote authenticated users to read and overwrite arbitrary files via unspecified vectors...

CVE-2006-3287

Cisco Wireless Control System (WCS) for Linux and Windows 4.0(1) and earlier is affected by a credential disclosure issue due to a default administrator username "root" and password "public," which allows remote attackers to gain access. This exposes partial confidentiality, integrity, and availa...

CVE-2006-3289

CVE-2006-3289 denotes a cross-site scripting (XSS) vulnerability in the login page of Cisco Wireless Control System (WCS) HTTP interface for Linux and Windows, affected in versions prior to 3.2(51). The issue allows remote attackers to inject arbitrary web script or HTML via vectors involving a m...

CVE-2006-3290

Cisco WCS on Linux/Windows prior to 3.2(51) stores sensitive information under the web root with insufficient access control, enabling remote retrieval of usernames and directory paths via a direct URL. Affected product: Cisco Wireless Control System (WCS). Root cause: improper access control ove...

CVE-2006-3288

CVE-2006-3288 affects Cisco Wireless Control System (WCS) TFTP server on Linux/Windows. The vulnerability arises when the configured directory path name contains a space character, allowing remote authenticated users to read and overwrite arbitrary files via unspecified vectors. Affected versions...

CVE-2006-3290

HTTP server in Cisco Wireless Control System WCS for Linux and Windows before 3.251 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames and directory paths via a direct URL request...

CVE-2006-3285

The internal database in Cisco Wireless Control System WCS for Linux and Windows before 3.251 uses an undocumented, hard-coded username and password, which allows remote authenticated users to read, and possibly modify, sensitive configuration data aka bugs CSCsd15955...

CVE-2006-3285

The CVE-2006-3285 entry concerns Cisco Wireless Control System (WCS) prior to version 3.2(51). The internal database uses an undocumented, hard-coded username and password, enabling remote authenticated users to read and potentially modify sensitive configuration data (CSCsd15955). Connected docu...

CVE-2006-3288: Undefined Security Weakness

Unspecified vulnerability in the TFTP server in Cisco Wireless Control System WCS for Linux and Windows before 3.251, when configured to use a directory path name that contains a space character, allows remote authenticated users to read and overwrite arbitrary files via unspecified vectors...

CVE-2001-0446

CVE-2001-0446 affects IBM WCS (WebSphere Commerce Suite) 4.0.1 with Application Server 3.0.2. The issue enables remote attackers to read source code for *.jsp files by appending a "/" to the requested URL, exposing partial confidentiality (C:P/I:N/A:N; CVSS v2 base 5.0). No exploitation details a...

CVE-2001-0446: Undefined Security Weakness

IBM WCS WebSphere Commerce Suite 4.0.1 with Application Server 3.0.2 allows remote attackers to read source code for .jsp files by appending a / to the requested URL...

CHINANSL Security Advisory(CSA-200107)

Topic: IBM WCS 4.0.1 + Application Server 3.0.2 for Solaris 2.7 show ".jsp" source Vulnerability. vulnerable: Solaris 2.7 + IBM WCS4.0,Application Server 3.0.2 discussion: follow URL insert "/" will be downloading ".jsp" source. exploits: http://target/index.jsp/ solution: to...

Дырка в IBM WCS

Пароли хранятся в открытом на чтение файле...

CHINANSL Security Advisory(CSA200013)

CHINANSL Security AdvisoryCSA200013 Topic: IBM WCS local user exceed his authority to access another file Release Dateёє Dec 25, 2000 Affected system: ============ IBM WCSWebsphere Commerce Suite ЎЎЎЎ+ Sun OS ЎЎЎЎ+ Sun Solaris ЎЎЎЎ+ Microsoft Windows NT ЎЎЎЎ+ Microsoft Windows 2000 ЎЎЎЎ+ HP HP-UX...