PT-2015-5485

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 7.0 through 7.0.0.38 IBM WebSphere Application Server WAS versions 8.0 through 8.0.0.10 IBM WebSphere Application Server WAS 8.5 Liberty Profile versions prior to 8.5.5.5 IBM WebSphere Application...

PT-2015-4511

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS 8.5 Liberty Profile versions prior to 8.5.5.5 Description The issue is related to the improper implementation of authData elements, which allows remote authenticated users to gain privileges. Recommendation...

PT-2015-5484

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS 8.5 Liberty Profile versions prior to 8.5.5.5 Description The issue is related to multiple race conditions that allow remote authenticated users to gain privileges. This is achieved by leveraging thread...

PT-2015-4510

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions prior to 8.5.5.5 Description The issue concerns the SNMP implementation, which does not properly handle configuration data. This allows remote authenticated users to obtain sensitive information...

CVE-2015-0174: Exposure of Sensitive Information to an Unauthorized Actor

The SNMP implementation in IBM WebSphere Application Server WAS 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2015-1882: Concurrent Execution using Shared Resource with Improper Synchronization

Multiple race conditions in IBM WebSphere Application Server WAS 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user...

Crlf injection

CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP...

CVE-2014-4803

IBM Cúram Universal Access (part of IBM Cúram Social Program Management) is vulnerable to a CRLF injection when not deployed on WebSphere, due to improper sanitization on a page parameter. A remote authenticated attacker could inject arbitrary HTTP headers and perform HTTP response splitting, pot...

CVE-2014-4803

CRLF injection vulnerability in the Universal Access implementation in IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5 iFix007, and 6.0.5 before 6.0.5.5 iFix003, when WebSphere Application Server is not used, allows remote authenticated users to inject arbitrary HTTP...

IBM WebSphere Application Server Directory Traversal Vulnerability (CNVD-2014-09182)

IBM WebSphere Application Server is developed by IBM in accordance with open standards and issued an application server. A directory traversal vulnerability in IBM WebSphere Application Server versions 8.0.x prior to 8.0.0.10 and 8.5.x prior to 8.5.5.4 allows remote attackers to read arbitrary...

IBM WebSphere Application Server Clickjacking Vulnerability

IBM WebSphere Application Server is developed by IBM in accordance with open standards and issued an application server. A clickjacking vulnerability in IBM WebSphere Application Server versions 7.x prior to 7.0.0.37, 8.0.x prior to 8.0.0.10, and 8.5.x prior to 8.5.5.4 allows remote attackers to...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability (CNVD-2014-09183)

IBM WebSphere Application Server is developed by IBM in accordance with open standards and issued an application server. Cross-site scripting vulnerability in IBM WebSphere Application Server versions 7.0.0.37 prior to 7.x, 8.0.0.10 prior to 8.0.x, and 8.5.5.4 prior to 8.5.x allows remote attacke...

PT-2014-7078

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.0.x through 8.0.0.9 IBM WebSphere Application Server versions 8.5.x through 8.5.5.3 Description The issue allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain...

CVE-2014-6166: Undefined Security Weakness

The Communications Enabled Applications CEA service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entit...

CVE-2014-6167: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the URL rewriting feature in IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

PT-2014-7080

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x through 7.0.0.36 IBM WebSphere Application Server versions 8.0.x through 8.0.0.9 IBM WebSphere Application Server versions 8.5.x through 8.5.5.3 Description A cross-site scripting XSS issue exists ...

PT-2014-7084

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0.0 through 7.0.0.36 IBM WebSphere Application Server versions 8.0.0 through 8.0.0.9 IBM WebSphere Application Server versions 8.5.0 through 8.5.5.3 Description The issue allows remote attackers to...

PT-2014-8747

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server Liberty Profile versions 8.5.x through 8.5.5.3 Description The issue allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and...

CVE-2014-8890: Undefined Security Weakness

IBM WebSphere Application Server Liberty Profile 8.5.x before 8.5.5.4 allows remote attackers to gain privileges by leveraging the combination of a servlet's deployment descriptor security constraints and ServletSecurity annotations...

CVE-2014-6174: Undefined Security Weakness

IBM WebSphere Application Server 7.x before 7.0.0.37, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.4 allows remote attackers to conduct clickjacking attacks via a crafted web site...