CVE-2016-9879

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...

PT-2017-10376

Name of the Vulnerable Software and Affected Versions Pivotal Spring Security versions 3.2.0 through 3.2.9 Pivotal Spring Security versions 4.0.x through 4.1.3 Pivotal Spring Security version 4.2.0 Description An issue was discovered in Pivotal Spring Security where it does not consider URL path...

CVE-2016-9879: Undefined Security Weakness

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM WAS. An...

IBM WebSphere Application Server 7.0 < 7.0.0.43 / 8.0 < 8.0.0.13 / 8.5 < 8.5.5.10 Information Disclosure

The version of the IBM WebSphere Application Server running on the remote host is 7.0 prior to 7.0.0.43, 8.0 prior to 8.0.0.13, or 8.5 prior to 8.5.5.10. It is, therefore, affected by an information disclosure vulnerability in the Administrative Console due to improperly setting the CSRFtoken...

CVE-2016-0378: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception...

PT-2016-4172

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty versions prior to 16.0.0.3 Description The issue allows remote attackers to obtain sensitive information by triggering an exception when the installation lacks a default error page. Recommendations...

IBM WebSphere Application Server 7.0 < 7.0.0.43 / 8.0 < 8.0.0.13 / 8.5 < 8.5.5.10 / 9.0 < 9.0.0.1 / Liberty 16.0 < 16.0.0.3 Information Disclosure

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.43, 8.0 prior to 8.0.0.13, 8.5 prior to 8.5.5.10, 9.0 prior to 9.0.0.1, or 16.0 Liberty prior to 16.0.0.3. It is, therefore, affected by an information disclosure vulnerability due to improper validation...

IBM WebSphere Application Server 7.0 < 7.0.0.43 / 8.0 < 8.0.0.13 / 8.5 < 8.5.5.11 / 9.0 < 9.0.0.2 Multiple Vulnerabilities

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.43, 8.0 prior to 8.0.0.13, 8.5 prior to 8.5.5.11, or 9.0 prior to 9.0.0.2. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to improper...

CVE-2016-0377

The Administrative Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2016-0377

CVE-2016-0377 is an information-disclosure vulnerability in IBM WebSphere Application Server caused by improper CSRFtoken cookie handling. It affects WAS 7.x up to 7.0.0.43, WAS 8.0.x up to 8.0.0.13, and WAS 8.5.x up to 8.5.5.10, allowing a remote authenticated attacker to obtain sensitive inform...

CVE-2016-0377: Exposure of Sensitive Information to an Unauthorized Actor

The Administrative Console in IBM WebSphere Application Server WAS 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors...

PT-2016-4171

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x before 7.0.0.43 IBM WebSphere Application Server versions 8.0.x before 8.0.0.13 IBM WebSphere Application Server versions 8.5.x before 8.5.5.10 Description The Administrative Console in IBM WebSphe...

IBM WebSphere Application Server Code Execution Vulnerability (Oct 2016)

IBM WebSphere Application Server is prone to a code execution vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-5983

IBM WebSphere Application Server WAS 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object...

CVE-2016-5983

IBM WebSphere Application Server WAS 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object...

CVE-2016-5983

CVE-2016-5983 is a code execution vulnerability in IBM WebSphere Application Server (WAS) and Liberty profiles due to deserialization of untrusted objects. Connected IBM security bulletins confirm affected products and versions across WAS and Liberty (including WAS 8.x/7.x line and Liberty profil...

CVE-2016-5983: Improper Access Control

IBM WebSphere Application Server WAS 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object...

PT-2016-6747

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 7.0 through 7.0.0.42 IBM WebSphere Application Server WAS versions 8.0 through 8.0.0.12 IBM WebSphere Application Server WAS versions 8.5 through 8.5.5.10 IBM WebSphere Application Server WAS...

IBM WebSphere Application Server Information Disclosure Vulnerability (swg21990056)

IBM WebSphere Application Server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...