CVE-2014-3022: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.3 allows remote attackers to obtain sensitive information via a crafted URL that triggers an error condition...

CVE-2014-3070: Undefined Security Weakness

The addFileRegistryAccount Virtual Member Manager VMM SPI Admin Task in IBM WebSphere Application Server WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2014-3083: Undefined Security Weakness

IBM WebSphere Application Server WAS 7.0.x before 7.0.0.35, 8.0.x before 8.0.0.10, and 8.5.x before 8.5.5.3 does not properly restrict resource access, which allows remote attackers to obtain sensitive information via unspecified vectors...

PT-2014-6106

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 8.0.x before 8.0.0.10 IBM WebSphere Application Server WAS versions 8.5.x before 8.5.5.3 Description The issue allows remote attackers to cause a denial of service, resulting in a Load Balancer...

PT-2014-6109

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions 8.5.x through 8.5.5.2 Description The issue arises from improper use of the Liberty Repository for feature installation, allowing remote authenticated users to execute arbitrary cod...

Crlf injection

Multiple CRLF injection vulnerabilities in the Universal Access component in IBM Curam Social Program Management SPM 6.0.5.5, when WebSphere Application Server is not used, allow remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecifie...

CVE-2014-3020

install.sh in the Embedded WebSphere Application Server eWAS 7.0 before FP33 in IBM Tivoli Integrated Portal TIP 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program...

PT-2014-5025

Name of the Vulnerable Software and Affected Versions IBM Tivoli Integrated Portal versions 2.1 and 2.2 with Embedded WebSphere Application Server eWAS 7.0 before FP33 Description The issue allows local users to gain privileges via a Trojan horse program due to world-writable permissions being se...

IBM HTTP Server 1.3.x Source Code Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3518/info Due to an input validation error in IBM HTTP Server for the AS/400, it is possible for a remote attacker to make a specially web crafted web request which will display script source code. If a '/' is appended to...

CVE-2014-0891: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information by leveraging incorrect request handling by the 1 Proxy or 2 ODR server...

PT-2014-3980

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.0.2.0 through 6.0.2.43 IBM WebSphere Application Server versions 6.1.0.0 through 6.1.0.47 Description The issue allows remote attackers to cause a denial of service via crafted TLS traffic...

CVE-2014-0964: Undefined Security Weakness

IBM WebSphere Application Server WAS 6.1.0.0 through 6.1.0.47 and 6.0.2.0 through 6.0.2.43 allows remote attackers to cause a denial of service via crafted TLS traffic, as demonstrated by traffic from a CVE-2014-0160 vulnerability-assessment tool...

PT-2014-1410

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0.x through 7.0.0.32 IBM WebSphere Application Server versions 8.0.x through 8.0.0.8 IBM WebSphere Application Server versions 8.5.x through 8.5.5.1 Description The issue allows remote attackers to...

CVE-2013-6323

Cross-site scripting XSS vulnerability in the Administration Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or...

Cross site scripting

Cross-site scripting XSS vulnerability in the Administration Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, and WebSphere Virtual Enterprise 7.x before 7.0.0.5, allows remote authenticated users to inject arbitrary web script or...

CVE-2014-0859

CVE-2014-0859 affects IBM WebSphere Application Server where the web server plugin configured to retry failed POST requests may cause a denial of service (daemon crash). Affected: WAS 7.x up to 7.0.0.33, WAS 8.x up to 8.0.0.9, WAS 8.5.x up to 8.5.5.2. Remediation: apply the corresponding Fix Pack...

CVE-2014-0857

CVE-2014-0857 affects IBM WebSphere Application Server (WAS) Administrative Console. Affected versions: WAS 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2. Description: remote authenticated users can obtain sensitive information via a crafted request due to improper handling of requests in the Admin...

PT-2014-1409

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 7.x through 7.0.0.32 IBM WebSphere Application Server WAS versions 8.x through 8.0.0.8 IBM WebSphere Application Server WAS versions 8.5.x through 8.5.5.1 Description The issue affects the web-serv...

PT-2014-1405

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x through 7.0.0.32 IBM WebSphere Application Server versions 8.x through 8.0.0.8 IBM WebSphere Application Server versions 8.5.x through 8.5.5.1 WebSphere Virtual Enterprise versions 7.x through...

CVE-2014-0859: Undefined Security Weakness

The web-server plugin in IBM WebSphere Application Server WAS 7.x before 7.0.0.33, 8.x before 8.0.0.9, and 8.5.x before 8.5.5.2, when POST retries are enabled, allows remote attackers to cause a denial of service daemon crash via unspecified vectors...