PT-2012-2391

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 6.0 through 6.0.2.43 IBM WebSphere Application Server WAS versions 6.1 before 6.1.0.43 IBM WebSphere Application Server WAS versions 7.0 before 7.0.0.23 IBM WebSphere Application Server WAS version...

CVE-2011-1376

iscdeploy in IBM WebSphere Application Server WAS 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under systemapps/isclite.ear/ and bin/clientffdc/, which allows local users to read or modify files via standard filesystem operations...

PT-2012-1512

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 6.1 before 6.1.0.43 IBM WebSphere Application Server WAS versions 7.0 before 7.0.0.21 IBM WebSphere Application Server WAS versions 8.0 before 8.0.0.2 Description The issue allows local users to re...

CVE-2011-1376: Undefined Security Weakness

iscdeploy in IBM WebSphere Application Server WAS 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under systemapps/isclite.ear/ and bin/clientffdc/, which allows local users to read or modify files via standard filesystem operations...

IBM WebSphere Application Server IVT Cross Site Scripting Vulnerability

The host is running IBM WebSphere Application Server and is prone to cross site scripting vulnerability. OpenVAS Vulnerability Test $Id: gbibmwasivtxssvuln.nasl 5999 2017-04-21 09:02:32Z teissa $ IBM WebSphere Application Server IVT Cross Site Scripting Vulnerability Authors: Antu Sanadi Copyrigh...

IBM WebSphere Application Server (WAS) Multiple Vulnerabilities - (Jan2012)

The host is running IBM WebSphere Application Server and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbibmwasmultvulnjan12.nasl 5977 2017-04-19 09:02:22Z teissa $ IBM WebSphere Application Server WAS Multiple Vulnerabilities - Jan2012 Authors: Antu Sanadi Copyright:...

CVE-2011-5065

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging...

CVE-2011-5066

The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus SIB dump operation involving the First Failure Data Capture FFDC introspection code, which allows local users to...

Code injection

The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server WAS 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors...

CVE-2011-5066

CVE-2011-5066 affects IBM WebSphere Application Server 6.1 (Default Messaging Component). The SibRaRecoverableSiXaResource class does not properly handle a Service Integration Bus (SIB) dump operation in the FFDC introspection code, allowing local users to read the FFDC log file and obtain sensit...

CVE-2011-5065: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging...

CVE-2011-5066: Exposure of Sensitive Information to an Unauthorized Actor

The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus SIB dump operation involving the First Failure Data Capture FFDC introspection code, which allows local users to...

CVE-2011-1377: Undefined Security Weakness

The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server WAS 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors...

PT-2012-1510

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1 before 6.1.0.41 IBM WebSphere Application Server versions 7.0 before 7.0.0.19 Description A cross-site scripting XSS issue exists in the Installation Verification Test IVT application, allowing...

PT-2012-2044

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions prior to 6.1.0.41 Description The issue concerns the SibRaRecoverableSiXaResource class in the Default Messaging Component, which does not properly handle a Service Integration Bus dump operation...

PT-2012-1513

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS 6.1 versions prior to 6.1.0.41 Description The Web Services Security component in the Web Services Feature Pack for IBM WebSphere Application Server does not properly handle the enabling of WS-Security for ...

CVE-2011-1362: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Installation Verification Test IVT application in the Install component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 and 7.0 before 7.0.0.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE:...

PT-2012-2043

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions prior to 6.1.0.41 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging. Recommendations For versions prior to...

DDIVRT-2011-33 IBM WebSphere Application Server 'help' Servlet Plug-in Bundle Directory Traversal [CVE-2011-1359]

Title ----- DDIVRT-2011-33 IBM WebSphere Application Server 'help' Servlet Plug-in Bundle Directory Traversal CVE-2011-1359 Severity -------- High Date Discovered --------------- July 28, 2011 Discovered By ------------- Digital Defense, Inc. Vulnerability Research Team Credit: Javier Castro,...

IBM WebSphere Application Server JNDI information disclosure Vulnerability

The host is running IBM WebSphere Application Server and is prone to information disclosure vulnerability. OpenVAS Vulnerability Test $Id: gbibmwasjndiimpinfodisclosurevuln.nasl 7044 2017-09-01 11:50:59Z teissa $ IBM WebSphere Application Server JNDI information disclosure Vulnerability Authors:...