Cross site scripting

Cross-site scripting XSS vulnerability in Eclipse Help in IBM WebSphere Application Server WAS 6.1 before 6.1.0.27 allows remote attackers to inject arbitrary web script or HTML via unspecified input...

CVE-2009-2742

Cross-site scripting XSS vulnerability in Eclipse Help in IBM WebSphere Application Server WAS 6.1 before 6.1.0.27 allows remote attackers to inject arbitrary web script or HTML via unspecified input...

CVE-2009-2743

IBM WebSphere Application Server WAS 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after use of wsadmin scripts and configuration of JAAS-J2C Authentication Data, which allows local users to obtain sensitive information by reading the First Failure...

CVE-2009-2742

Cross-site scripting XSS vulnerability in Eclipse Help in IBM WebSphere Application Server WAS 6.1 before 6.1.0.27 allows remote attackers to inject arbitrary web script or HTML via unspecified input...

CVE-2009-2742

IBM WebSphere Application Server 6.1 before 6.1.0.27 is affected by a cross-site scripting (XSS) vulnerability in the Eclipse Help component. The root cause is insufficient validation of input in Eclipse Help, allowing remote attackers to inject arbitrary script/HTML via unspecified input. Affect...

IBM WebSphere Application Server拒绝服务漏洞

Bugraq ID: 36456 CVE ID：CVE-2009-2744 IBM WebSphere Application Server是一款商业性质的WEB应用服务程序。 IBM WebSphere Application Server存在一个未明安全漏洞，远程攻击者可以利用漏洞对服务程序进行拒绝服务攻击。 目前没有详细漏洞细节提供。 IBM Websphere Application Server 6.1 25 IBM Websphere Application Server 6.1 23 厂商解决方案 用户可联系供应商下载使用最新的Fix Pack 6.1.0.27或之后或AP...

IBM WebSphere Application Server本地信息泄漏漏洞

Bugraq ID: 36458 CVE ID：CVE-2009-2743 IBM WebSphere Application Server是一款商业性质的WEB应用服务程序。 IBM WebSphere Application Server允许本地攻击者获得敏感信息。 在使用wsadmin脚本和配置了JAAS-J2C验证数据后，当部分异常发生时存在一个错误，通过查看FFDC日志文件，攻击者可以获得敏感信息。 IBM Websphere Application Server 6.1 25 IBM Websphere Application Server 6.1 23 IBM...

IBM WebSphere Application Server Eclipse Help跨站脚本漏洞

Bugraq ID: 36455 CVE ID：CVE-2009-2742 IBM WebSphere Application Server是一款商业性质的WEB应用服务程序。 IBM WebSphere Application Server包含的Eclipse Help组件不正确验证用户提供的输入，远程攻击者可以利用漏洞使用特殊构建的URL，诱使用户点击，可在目标用户浏览器上执行任意脚本代码。 目前没有详细漏洞细节提供。 IBM Websphere Application Server 6.1 25 IBM Websphere Application Server 6.1 23 IBM...

CVE-2009-0906

The Service Component Architecture SCA feature pack for IBM WebSphere Application Server WAS SCA 1.0 before 1.0.0.3 allows remote authenticated users to bypass intended authentication.transport access restrictions and obtain unspecified access via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in wsadmin in the System Management/Repository component in IBM WebSphere Application Server WAS 7.0 before 7.0.0.5 allows remote attackers to bypass intended Java Management Extensions JMX Management Beans aka MBeans access restrictions, and cause a denial of service...

CVE-2009-2087

The Web Services functionality in IBM WebSphere Application Server WAS 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, in certain circumstances involving the ibm-webservicesclient-bind.xmi file and custom password encryption, uses weak password obfuscation, which allows local users to cause a denial ...

CVE-2009-2089

CVE-2009-2089 affects IBM WebSphere Application Server: the Migration component in WAS 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 can reveal sensitive information by readers of a Migration Trace file when tracing during a 6.1→7.0 migration. The issue enables remote authenticated users to obtain p...

CVE-2009-2087

The Web Services functionality in IBM WebSphere Application Server WAS 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, in certain circumstances involving the ibm-webservicesclient-bind.xmi file and custom password encryption, uses weak password obfuscation, which allows local users to cause a denial ...

CVE-2009-0904

The CVE-2009-0904 issue affects IBM WebSphere Application Server 6.1 before 6.1.0.25, specifically the Stax XMLStreamWriter in the Web Services component. The root cause is improper XML encoding handling, which can allow remote attackers to bypass access controls and potentially modify data via X...

Design/Logic Flaw

IBM FileNet Content Manager 4.0, 4.0.1, and 4.5, as used in IBM WebSphere Application Server WAS and Oracle BEA WebLogic Application Server, when the CE Web Services listener has a certain WSEAF configuration, does not properly restrict use of a cached Subject, which allows remote attackers to...

CVE-2009-1953

IBM FileNet Content Manager 4.0, 4.0.1, and 4.5, as used in IBM WebSphere Application Server WAS and Oracle BEA WebLogic Application Server, when the CE Web Services listener has a certain WSEAF configuration, does not properly restrict use of a cached Subject, which allows remote attackers to...

CVE-2009-1899

Unspecified vulnerability in the Administrative Configservice API in the System Management/Repository component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5 on z/OS allows remote authenticated users to obtain sensitive information via...

Code injection

Unspecified vulnerability in the Administrative Configservice API in the System Management/Repository component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5 on z/OS allows remote authenticated users to obtain sensitive information via...

CVE-2009-1901

The Security component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.35 permits "non-standard http methods," which has unknown impact and remote attack vectors...

CVE-2009-1899

Unspecified vulnerability in the Administrative Configservice API in the System Management/Repository component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5 on z/OS allows remote authenticated users to obtain sensitive information via...