Design/Logic Flaw

The Web Server Plug-in in IBM WebSphere Application Server WAS 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password, which allows remote attackers to obtain sensitive information by sniffing the network, or spoof arbitrary servers via a...

CVE-2012-2162

The Web Server Plug-in in IBM WebSphere Application Server WAS 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password, which allows remote attackers to obtain sensitive information by sniffing the network, or spoof arbitrary servers via a...

CVE-2012-2162: Undefined Security Weakness

The Web Server Plug-in in IBM WebSphere Application Server WAS 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password, which allows remote attackers to obtain sensitive information by sniffing the network, or spoof arbitrary servers via a...

IBM WebSphere Application Server Community Edition Tomcat Container拒绝服务漏洞

BUGTRAQ ID: 51345 IBM WebSphere Application Server WAS是由IBM遵照开放标准，例如Java EE, XML 还有Web Services，开发并发行的一种应用服务器。与其兼容的Web服务器包括：Apache HTTP Server，Netscape Enterprise Server，Microsoft Internet Information Services IIS以及IBM HTTP Server。 IBM WebSphere Application Server Community...

IBM WebSphere Application Server for z/OS JAX-RPC远程安全漏洞

BUGTRAQ ID: 52250 CVE ID: CVE-2012-0199 IBM WebSphere Application Server WAS是由IBM遵照开放标准，例如Java EE, XML 还有Web Services，开发并发行的一种应用服务器。与其兼容的Web服务器包括：Apache HTTP Server，Netscape Enterprise Server，Microsoft Internet Information Services IIS以及IBM HTTP Server。 IBM WebSphere Application Server for...

IBM WebSphere Application Server Hash Collisions DOS Vulnerability

The host is running IBM WebSphere Application Server and is prone to denial of service vulnerability. OpenVAS Vulnerability Test $Id: gbibmwashashcollisionsdosvuln.nasl 5940 2017-04-12 09:02:05Z teissa $ IBM WebSphere Application Server Hash Collisions DOS Vulnerability Authors: Antu Sanadi...

CVE-2012-0193

IBM WebSphere Application Server WAS 6.0 through 6.0.2.43, 6.1 before 6.1.0.43, 7.0 before 7.0.0.23, and 8.0 before 8.0.0.3 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service C...

CVE-2012-0193: Improper Input Validation

IBM WebSphere Application Server WAS 6.0 through 6.0.2.43, 6.1 before 6.1.0.43, 7.0 before 7.0.0.23, and 8.0 before 8.0.0.3 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service C...

CVE-2011-1376

iscdeploy in IBM WebSphere Application Server WAS 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under systemapps/isclite.ear/ and bin/clientffdc/, which allows local users to read or modify files via standard filesystem operations...

CVE-2011-1376: Undefined Security Weakness

iscdeploy in IBM WebSphere Application Server WAS 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under systemapps/isclite.ear/ and bin/clientffdc/, which allows local users to read or modify files via standard filesystem operations...

IBM WebSphere Application Server IVT Cross Site Scripting Vulnerability

The host is running IBM WebSphere Application Server and is prone to cross site scripting vulnerability. OpenVAS Vulnerability Test $Id: gbibmwasivtxssvuln.nasl 5999 2017-04-21 09:02:32Z teissa $ IBM WebSphere Application Server IVT Cross Site Scripting Vulnerability Authors: Antu Sanadi Copyrigh...

IBM WebSphere Application Server (WAS) Multiple Vulnerabilities - (Jan2012)

The host is running IBM WebSphere Application Server and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbibmwasmultvulnjan12.nasl 5977 2017-04-19 09:02:22Z teissa $ IBM WebSphere Application Server WAS Multiple Vulnerabilities - Jan2012 Authors: Antu Sanadi Copyright:...

CVE-2011-5065

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging...

Code injection

The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server WAS 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors...

CVE-2011-5066

The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus SIB dump operation involving the First Failure Data Capture FFDC introspection code, which allows local users to...

CVE-2011-5066

CVE-2011-5066 affects IBM WebSphere Application Server 6.1 (Default Messaging Component). The SibRaRecoverableSiXaResource class does not properly handle a Service Integration Bus (SIB) dump operation in the FFDC introspection code, allowing local users to read the FFDC log file and obtain sensit...

CVE-2011-1362: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Installation Verification Test IVT application in the Install component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 and 7.0 before 7.0.0.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE:...

CVE-2011-5066: Exposure of Sensitive Information to an Unauthorized Actor

The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus SIB dump operation involving the First Failure Data Capture FFDC introspection code, which allows local users to...

CVE-2011-1377: Undefined Security Weakness

The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server WAS 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors...

CVE-2011-5065: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging...