IBM Web Content Manager 'LIBRARY' Parameter XPath Injection Vulnerability

IBM Web Content Manager is prone to an XPath-injection vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

IBM Web Content Manager information leakage

It's possible to obtain configuration data...

SEC Consult SA-20131227-0 :: IBM Web Content Manager (WCM) XPath Injection

SEC Consult Vulnerability Lab Security Advisory 20131227-0 ======================================================================= title: XPath Injection product: IBM Web Content Manager WCM vulnerable version: 6.x, 7.x, 8.x fixed version: - impact: high homepage: http://www.ibm.com/ found:...

IBM Web Content Manager XPath Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XPath Injection product: IBM Web Content Manager WCM vulnerable version: 6.x, 7.x, 8.x fixed version: - impact: high homepage: http://www.ibm.com/ found: 2013-10-27 CVE:...

CVE-2013-6328

Cross-site scripting XSS vulnerability in the Web Content Manager WCM UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x before 8.0.0.1 CF09 allows remote attackers to inject arbitrary web script or HTML via vectors...

CVE-2013-6316

IBM WebSphere Portal 7.0.0.x before 7.0.0.2 CF26 and 8.0.0.x before 8.0.0.1 CF09 does not properly handle content-selection changes during Taxonomy component rendering, which allows remote attackers to obtain sensitive property information in opportunistic circumstances by leveraging an error in ...

Design/Logic Flaw

IBM WebSphere Portal 7.0.0.x before 7.0.0.2 CF26 and 8.0.0.x before 8.0.0.1 CF09 does not properly handle content-selection changes during Taxonomy component rendering, which allows remote attackers to obtain sensitive property information in opportunistic circumstances by leveraging an error in ...

Code injection

IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository JCR information via a modified Web...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web Content Manager WCM UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x before 8.0.0.1 CF09 allows remote attackers to inject arbitrary web script or HTML via vectors...

CVE-2013-6328

Cross-site scripting XSS vulnerability in the Web Content Manager WCM UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x before 8.0.0.1 CF09 allows remote attackers to inject arbitrary web script or HTML via vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web Content Manager - Web Content Viewer Portlet in the server in IBM WebSphere Portal 7.0.0.x through 7.0.0.2 CF22 and 8.0.0.x through 8.0.0.1 CF5, when the IBM Portlet API is used, allows remote attackers to inject arbitrary web script or HTML via a...

CVE-2013-0549

Cross-site scripting XSS vulnerability in the Web Content Manager - Web Content Viewer Portlet in the server in IBM WebSphere Portal 7.0.0.x through 7.0.0.2 CF22 and 8.0.0.x through 8.0.0.1 CF5, when the IBM Portlet API is used, allows remote attackers to inject arbitrary web script or HTML via a...

CVE-2013-0549

The CVE records a cross-site scripting vulnerability in IBM WebSphere Portal’s Web Content Viewer Portlet. Affected product: WebSphere Portal server (IBM Web Content Manager – Web Content Viewer Portlet). Vulnerable component: the Web Content Viewer Portlet when the IBM Portlet API is used. Root ...

Code injection

ar web content manager AWCM 2.2 does not restrict the number of comment records that can be submitted through HTTP requests, which allows remote attackers to cause a denial of service disk consumption via the coment parameter to 1 showvideo.php or 2 topic.php...

CVE-2012-2437

AWCM 2.2 contains an unauthenticated cookie forgery vulnerability in cookie_gen.php. An attacker can forge arbitrary cookies by supplying name and content parameters without authentication, as described in multiple sources (PoC shows requests like /awcm/cookie_gen.php?name=...&content=...). Root ...

CVE-2012-2438

AWCM 2.2 is vulnerable to an access-control flaw that lets unauthenticated attackers insert millions of comment records through the HTTP parameter com ent to show_video.php or topic.php, leading to disk consumption DoS. Root cause is lack of access protection for comment insertion. PoC examples e...

AR Web Content Manager (AWCM) - cookie_gen.php Arbitrary Cookie Generation

AR Web Content Manager AWCM - cookiegen.php Arbitrary Cookie Generation source: https://www.securityfocus.com/bid/56465/info AWCM is prone to an authentication-bypass and multiple security-bypass vulnerabilities. Attackers can exploit these vulnerabilities to bypass certain security restrictions,...

AR Web Content Manager (AWCM) - 'cookie_gen.php' Arbitrary Cookie Generation

source: https://www.securityfocus.com/bid/56465/info AWCM is prone to an authentication-bypass and multiple security-bypass vulnerabilities. Attackers can exploit these vulnerabilities to bypass certain security restrictions, perform unauthorized actions; which may aid in further attacks. AWCM 2....

CVE-2011-2754

Cross-site scripting XSS vulnerability in the PageBuilder2 aka Page Builder theme in IBM WebSphere Portal 7.x before 7.0.0.1 CF006, as used in IBM Web Content Manager WCM and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the PageBuilder2 aka Page Builder theme in IBM WebSphere Portal 7.x before 7.0.0.1 CF006, as used in IBM Web Content Manager WCM and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...