IBM WebSphere Application Server WS-Security XML Encryption Weakness Vulnerability (May 2011)

IBM WebSphere Application Server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Design/Logic Flaw

IBM WebSphere Application Server WAS 6.1 before 6.1.0.39 and 7.0 before 7.0.0.17 uses a weak WS-Security XML encryption algorithm, which makes it easier for remote attackers to obtain plaintext data from a 1 JAX-RPC or 2 JAX-WS Web Services request via unspecified vectors related to a "decryption...

CVE-2011-1209

CVE-2011-1209 affects IBM WebSphere Application Server: WAS 6.1 before 6.1.0.39 and WAS 7.0 before 7.0.0.17 use a weak WS-Security XML encryption algorithm, enabling a remote decryption attack to obtain plaintext data from JAX-RPC/JAX-WS requests. Exploitation details/vectors are not specified in...

CVE-2011-1209

IBM WebSphere Application Server WAS 6.1 before 6.1.0.39 and 7.0 before 7.0.0.17 uses a weak WS-Security XML encryption algorithm, which makes it easier for remote attackers to obtain plaintext data from a 1 JAX-RPC or 2 JAX-WS Web Services request via unspecified vectors related to a "decryption...

IBM WebSphere Application Server WS-Security Policy Unspecified vulnerability

The host is running IBM WebSphere Application Server and is prone to unspecified vulnerability. OpenVAS Vulnerability Test $Id: secpodibmwastimestampunspecifiedvuln.nasl 5394 2017-02-22 09:22:42Z teissa $ IBM WebSphere Application Server WS-Security Policy Unspecified vulnerability Authors: Antu...

IBM WebSphere Application Server 7.x < 7.0.0.13 WS-Security Policy Vulnerability

IBM WebSphere Application Server is prone to a vulnerability when using WS-Security enabled JAX-WS web service application. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

IBM WebSphere Application Server 6.0 < 6.0.2.41 Multiple Vulnerabilities

IBM WebSphere Application Server 6.0 before Fix Pack 41 for 6.0.2 appears to be running on the remote host. As such, it is reportedly affected by multiple vulnerabilities : - An unspecified cross-site scripting vulnerability in the Administration Console. PK97376 - An error when defining a wsadmi...

Websphere 7.0.0.1 ws-security 模块存在session劫持攻击漏洞

No description provided by source...

CVE-2009-0903

IBM WebSphere Application Server WAS 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remot...

IBM WebSphere Application Server < 6.1.0.23 Multiple Vulnerabilities

Binary data 4996.prm...

IBM WebSphere Application Server 7.0 < Fix Pack 3 Multiple Vulnerabilities

Binary data 4991.prm...

IBM WebSphere Application Server < 6.1.0.23 Multiple Flaws

IBM WebSphere Application Server 6.1 before Fix Pack 23 appears to be installed on the remote host. Such versions are reportedly affected by multiple vulnerabilities : - Provided an attacker has valid credentials, it may be possible to hijack an authenticated session. PK66676 - It may be possible...

IBM WebSphere Application Server < 6.0.2.33 Multiple Vulnerabilities

IBM WebSphere Application Server 6.0.2 before Fix Pack 33 appears to be running on the remote host. As such, it is reportedly affected by multiple vulnerabilities : - Provided an attacker has valid credentials, it may be possible to hijack an authenticated session. PK66676 - The PerfServlet code...

Code injection

The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has unknown impact and attack vectors...

CVE-2009-1172

CVE-2009-1172 affects IBM WebSphere Application Server (WAS). The JAX-RPC WS-Security runtime in WAS 6.1 before 6.1.0.23 and WAS 7.0 before 7.0.0.3, with APAR PK41002 installed, does not properly validate UsernameToken objects. The initial description notes impact as unknown and does not provide ...

CVE-2009-1172

The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has unknown impact and attack vectors...

Design/Logic Flaw

The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 7.0.0.1, 6.1 before Fix Pack 23 6.1.0.23,and 6.0.2 before Fix Pack 33 6.0.2.33 does not properly enforce 1 nonce and 2 timestamp expiration values in WS-Security bindings as stored in the...

CVE-2009-0891

The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 7.0.0.1, 6.1 before Fix Pack 23 6.1.0.23,and 6.0.2 before Fix Pack 33 6.0.2.33 does not properly enforce 1 nonce and 2 timestamp expiration values in WS-Security bindings as stored in the...

Authentication flaw

The WSEE runtime WS-Security runtime in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security...

CVE-2007-0416

The WSEE runtime WS-Security runtime in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security...