CVE-2016-0378: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception...

IBM WebSphere Application Server 7.0 < 7.0.0.43 / 8.0 < 8.0.0.13 / 8.5 < 8.5.5.10 / 9.0 < 9.0.0.1 / Liberty 16.0 < 16.0.0.3 Information Disclosure

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.43, 8.0 prior to 8.0.0.13, 8.5 prior to 8.5.5.10, 9.0 prior to 9.0.0.1, or 16.0 Liberty prior to 16.0.0.3. It is, therefore, affected by an information disclosure vulnerability due to improper validation...

IBM WebSphere Application Server 7.0 < 7.0.0.43 / 8.0 < 8.0.0.13 / 8.5 < 8.5.5.11 / 9.0 < 9.0.0.2 Multiple Vulnerabilities

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.43, 8.0 prior to 8.0.0.13, 8.5 prior to 8.5.5.11, or 9.0 prior to 9.0.0.2. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to improper...

CVE-2016-0377

The Administrative Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2016-0377

CVE-2016-0377 is an information-disclosure vulnerability in IBM WebSphere Application Server caused by improper CSRFtoken cookie handling. It affects WAS 7.x up to 7.0.0.43, WAS 8.0.x up to 8.0.0.13, and WAS 8.5.x up to 8.5.5.10, allowing a remote authenticated attacker to obtain sensitive inform...

CVE-2016-0377: Exposure of Sensitive Information to an Unauthorized Actor

The Administrative Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors...

IBM WebSphere Application Server Code Execution Vulnerability (Oct 2016)

IBM WebSphere Application Server is prone to a code execution vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-5983

IBM WebSphere Application Server WAS 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object...

CVE-2016-5983

IBM WebSphere Application Server WAS 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object...

CVE-2016-5983

CVE-2016-5983 is a code execution vulnerability in IBM WebSphere Application Server (WAS) and Liberty profiles due to deserialization of untrusted objects. Connected IBM security bulletins confirm affected products and versions across WAS and Liberty (including WAS 8.x/7.x line and Liberty profil...

CVE-2016-5983: Improper Access Control

IBM WebSphere Application Server WAS 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object...

IBM WebSphere Application Server Information Disclosure Vulnerability (swg21990056)

IBM WebSphere Application Server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-3042

CVE-2016-3042 affects IBM WebSphere Application Server Liberty (OpenID Connect clients) and is a cross-site scripting vulnerability that could allow arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. IBM bulletins confirm the vulnerability ...

CVE-2016-5986: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mishandles responses, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2016-3042: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Web UI in IBM WebSphere Application Server WAS Liberty before 16.0.0.3 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving OpenID Connect clients...

CVE-2016-3040

IBM WebSphere Application Server WAS Liberty, as used in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Code injection

IBM WebSphere Application Server WAS Liberty, as used in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-3040: URL Redirection to Untrusted Site

IBM WebSphere Application Server WAS Liberty, as used in IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8, allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

IBM WebSphere Application Server Information Disclosure Vulnerability (CNVD-2016-08095)

IBM WebSphere Application Server is an application server product developed and distributed by IBM in the United States, which is a platform for Java EE and Web services applications. A security vulnerability exists in IBM WebSphere Application Server. A remote attacker can exploit the...

IBM WebSphere Application Server Liberty Profile Cross-Site Scripting Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform.Liberty Profile is a WAS dynamic server Liberty Profile is a...