CVE-2017-1194

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 123669...

CVE-2017-1194: Cross-Site Request Forgery (CSRF)

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 123669...

PT-2017-12318

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to cross-site request forgery. Recommendations...

IBM WebSphere Application Server 7.0.0.x < 7.0.0.35 Multiple Vulnerabilities

Binary data 700044.prm...

The vulnerability of WebSphere Application Server for application servers allows attackers to increase their privileges.

The vulnerability of OIDC components and TAI server components of WebSphere Application Server is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

CVE-2017-1151: Undefined Security Weakness

IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect OIDC configured with a Trust Association Interceptor TAI could allow a user to gain elevated privileges on the system. IBM Reference : 1999293...

PT-2017-1546

Name of the Vulnerable Software and Affected Versions WebSphere Application Server versions 8.0 through 9.0 Description The issue is related to insufficient access control in the OpenID Connect OIDC and Trust Association Interceptor TAI components of the WebSphere Application Server. This could...

IBM WebSphere Application Server Remote Elevation of Privilege Vulnerability (CNVD-2017-03344)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for JavaEE and Web services applications, and is the foundation of the IBM WebSphere software platform. A remote elevation of privilege vulnerability exists in IBM...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability (CNVD-2017-01846)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM WAS. An...

IBM WebSphere Application Server Multiple Vulnerabilities (swg21997743, swg21993797, swg21992315)

IBM WebSphere Application Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-1121: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference...

PT-2017-11822

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trust...

IBM WebSphere Application Server Information Disclosure Vulnerability (CNVD-2017-01515)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. An information disclosure vulnerability exists in IBM...

CVE-2016-8919: Undefined Security Weakness

IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources...

PT-2017-9866

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server affected versions not specified Description The issue allows serialized objects from untrusted sources to run, causing the consumption of resources, which may lead to a denial of service. Recommendations At the...

CVE-2016-8934: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2017-9880

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within ...

IBM WebSphere Application Server Denial of Service Vulnerability (CNVD-2017-01036)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A denial of service vulnerability exists in IBM WebSphere...

Design/Logic Flaw

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...

CVE-2016-9879

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...