Design/Logic Flaw

IBM WebSphere Application Server WAS 6.1.x before 6.1.0.31 and 7.0.x before 7.0.0.11, when Basic authentication and SIP tracing aka full trace logging for SIP are enabled, logs the entirety of all inbound and outbound SIP messages, which allows local users to obtain sensitive information by readi...

CVE-2010-1650: Undefined Security Weakness

IBM WebSphere Application Server WAS 6.0.x before 6.0.2.41, 6.1.x before 6.1.0.31, and 7.0.x before 7.0.0.11, when the -trace option aka debugging mode is enabled, executes debugging statements that print string representations of unspecified objects, which allows attackers to obtain sensitive...

CVE-2010-1651: Undefined Security Weakness

IBM WebSphere Application Server WAS 6.1.x before 6.1.0.31 and 7.0.x before 7.0.0.11, when Basic authentication and SIP tracing aka full trace logging for SIP are enabled, logs the entirety of all inbound and outbound SIP messages, which allows local users to obtain sensitive information by readi...

CVE-2010-0770

IBM WebSphere Application Server WAS 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 allows remote authenticated users to cause a denial of service ORB ListenerThread hang by aborting an SSL handshake...

CVE-2010-0768

CVE-2010-0768 is an XSS flaw in IBM WebSphere Application Server Administration Console. Affected products are WAS 6.0 before 6.0.2.41, WAS 6.1 before 6.1.0.31, and WAS 7.0 before 7.0.0.9, where arbitrary web script or HTML could be injected via the URI. Public sources in connected documents corr...

CVE-2010-0770

IBM WebSphere Application Server WAS 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 allows remote authenticated users to cause a denial of service ORB ListenerThread hang by aborting an SSL handshake...

IBM WebSphere Application Server multiple vulnerabilities

IBM WebSphere Application Server WAS is prone to multiple vulnerabilities. 1. A cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in...

CVE-2010-0768: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Administration Console in IBM WebSphere Application Server WAS 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 allows remote attackers to inject arbitrary web script or HTML via the URI...

CVE-2010-0769: Undefined Security Weakness

IBM WebSphere Application Server WAS 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 does not properly define wsadmin scripting J2CConnectionFactory objects, which allows local users to discover a KeyRingPassword password by reading a cleartext field in the resources.xml file...

IBM WebSphere Application Server Multiple Vulnerabilities (swg27004980)

IBM WebSphere Application Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2010-0770: Undefined Security Weakness

IBM WebSphere Application Server WAS 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 allows remote authenticated users to cause a denial of service ORB ListenerThread hang by aborting an SSL handshake...

CVE-2010-1182: Undefined Security Weakness

Multiple unspecified vulnerabilities in the administrative console in IBM WebSphere Application Server WAS 7.0.x before 7.0.0.9 on z/OS have unknown impact and attack vectors...

CVE-2010-0563: Exposure of Sensitive Information to an Unauthorized Actor

The Single Sign-on SSO functionality in IBM WebSphere Application Server WAS 7.0.0.0 through 7.0.0.8 does not recognize the Requires SSL configuration option, which might allow remote attackers to obtain sensitive information by sniffing network sessions that were expected to be encrypted...

xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

CVE-2009-2749: Undefined Security Weakness

Feature Pack for Communications Enabled Applications CEA before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable session values, which allows man-in-the-middle attackers to spoof a collaboration session by guessing the value...

IBM WebSphere Application Server Buffer Overflow (CVE-2005-1872)

The IBM WebSphere Application Server is a Java 2 Enterprise Edition J2EE and Web Services-based application server. The software is made available for various vendor operating systems. There exists a buffer overflow vulnerability in IBM's WebSphere Application Server. The vulnerability is caused ...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the administrative console in the Security component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 allows remote attackers to hijack the authentication of administrators via unspecified...

CVE-2009-2746

Cross-site request forgery CSRF vulnerability in the administrative console in the Security component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 allows remote attackers to hijack the authentication of administrators via unspecified...

CVE-2009-2746: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the administrative console in the Security component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 allows remote attackers to hijack the authentication of administrators via unspecified...

CVE-2009-2743

IBM WebSphere Application Server WAS 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after use of wsadmin scripts and configuration of JAAS-J2C Authentication Data, which allows local users to obtain sensitive information by reading the First Failure...