CVE-2015-4947

CVE-2015-4947 is a stack-based buffer overflow in the IBM HTTP Server Administration Server, affecting IBM HTTP Server versions 6.1.0.x up to 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7, used with WebSphere Application Server and other products. An authent...

The vulnerability of WebSphere Application Server’s application servers allows attackers to inject arbitrary web or HTML code.

The vulnerability of WebSphere Application Server exists because measures are not taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to inject any desired web or HTML code using a specially crafted URL...

IBM WebSphere Application Server and WebSphere Virtual Enterprise Information Disclosure Vulnerability

IBM WebSphere Application Server WAS and WebSphere Virtual Enterprise WVE are both products of IBM Corporation, U.S.A. WAS is an application server product; WVE is a set of application server virtualization solutions. There are security vulnerabilities in IBM WAS and WVE. A remote attacker could...

PT-2015-5508

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x through 7.0.0.38 IBM WebSphere Application Server versions 8.0.x through 8.0.0.10 IBM WebSphere Application Server versions 8.5.x through 8.5.5.6 IBM WebSphere Virtual Enterprise version 7.0.0.6 an...

PT-2015-6728

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x through 7.0.0.38 IBM WebSphere Application Server versions 8.0.x through 8.0.0.10 IBM WebSphere Application Server versions 8.5.x through 8.5.5.6 Description The issue allows remote attackers to...

CVE-2015-1932: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header...

CVE-2015-4938: Undefined Security Weakness

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors...

The vulnerability of WebSphere Application Server application servers allows a hacker to gain privileged access.

The vulnerability of WebSphere Application Server applications is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain privileged access by manipulating the value of the object...

The vulnerability of WebSphere Application Server for application servers allows attackers to increase their privileges.

The vulnerability of WebSphere Application Server applications is related to deficiencies in access control for certain functions. Exploiting this vulnerability can allow an attacker, operating locally, to increase their privileges due to errors in the configuration of access control rules...

Default configuration

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...

PT-2015-1648

Name of the Vulnerable Software and Affected Versions WebSphere Application Server versions 7.0.0 through 7.0.0.38 WebSphere Application Server versions 8.0.0 through 8.0.0.10 WebSphere Application Server versions 8.5 through 8.5.5.5 Description The issue is related to insufficient access control...

PT-2015-1649

Name of the Vulnerable Software and Affected Versions WebSphere Application Server versions 8.0.0 through 8.0.0.10 WebSphere Application Server versions 8.5 through 8.5.5.5 Description The issue is related to inadequate access control in the administrative console of the WebSphere Application...

PT-2015-1651

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 8.5 before 8.5.5.6 IBM WebSphere Virtual Enterprise version 7.0 before 7.0.0.6 for WebSphere Application Server 7.0 and 8.0 Description The issue is related to improper implementation of user roles and...

CVE-2015-1936: Improper Access Control

The administrative console in IBM WebSphere Application Server WAS 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter...

CVE-2015-1946: Undefined Security Weakness

IBM WebSphere Application Server WAS 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server WAS 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors...

CVE-2015-1927: Improper Access Control

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...

IBM WebSphere Application Server Session Hijacking Vulnerability

IBM WebSphere Application Server is an application server product that serves as a platform for Java EE and Web services applications and is the foundation of the IBM WebSphere software platform. A session hijacking vulnerability exists in IBM WebSphere Application Server, which allows remote...

IBM WebSphere Application Server and WebSphere Virtual Enterprise Local Privilege Vulnerability

IBM WebSphere Application Server WAS and WebSphere Virtual Enterprise WVE are both products of IBM Corporation, U.S.A. WAS is an application server product; WVE is a set of application server virtualization solutions. The IBM WebSphere Application Server and WebSphere Virtual Enterprise local...

IBM WebSphere Application Server Remote Elevation of Privilege Vulnerability (CNVD-2015-04409)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A remote boost vulnerability exists in IBM WAS. An attacker...

PT-2015-1417

Name of the Vulnerable Software and Affected Versions WebSphere Application Server versions prior to the fixed version IBM Business Process Manager BPM versions 7.5.x through 7.5.1.2 IBM Business Process Manager BPM versions 8.0.x through 8.0.1.3 IBM Business Process Manager BPM versions 8.5.0...