CVE-2008-4285: Undefined Security Weakness

Unspecified vulnerability in the Performance Monitoring Infrastructure PMI feature in the Servlet Engine/Web Container component in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.19, when a component statistic is enabled, allows attackers to cause a denial of service daemon crash via...

Code injection

The 1 modibmssl and 2 modcgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server WAS, set incorrect permissions for AFUNIX sockets, which has unknown impact and local attack vectors...

CVE-2009-0432

The installation process for the File Transfer servlet in the System Management/Repository component in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.19 does not enable the secure version, which allows remote attackers to obtain sensitive information via unspecified vectors...

Information disclosure

The Installation Factory installation process for IBM WebSphere Application Server WAS 6.0.2 on Windows, when WAS is registered as a Windows service, allows local users to obtain sensitive information by reading the logs/instconfigifwas6.log log file...

CVE-2009-0435

IBM WebSphere Application Server 6.1.x on AIX 5.3 is affected by a denial-of-service vulnerability in the IBM JMS AIO/libibmaio library (aio_getioev2 and getEvent). The issue exists in WAS 6.1.x before 6.1.0.17 and can cause a daemon crash. Remediation: upgrade to WAS 6.1.0.17 or later Fix Pack t...

CVE-2009-0435

Unspecified vulnerability in the IBM Asynchronous I/O aka AIO or libibmaio library in the Java Message Service JMS component in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.17 on AIX 5.3 allows attackers to cause a denial of service daemon crash via vectors related to the aiogetioev2 a...

CVE-2009-0436

CVE-2009-0436 affects IBM HTTP Server integrated with WebSphere (was 6.0.x prior to 6.0.2.31; 6.1.x prior to 6.1.0.19). The mod_ibm_ssl and mod_cgid modules set incorrect permissions on AF_UNIX sockets. Impact is described as unknown and local access vectors are indicated; no public exploit detai...

CVE-2009-0437: Exposure of Sensitive Information to an Unauthorized Actor

The Installation Factory installation process for IBM WebSphere Application Server WAS 6.0.2 on Windows, when WAS is registered as a Windows service, allows local users to obtain sensitive information by reading the logs/instconfigifwas6.log log file...

CVE-2009-0438: Undefined Security Weakness

IBM WebSphere Application Server WAS 7 before 7.0.0.1 on Windows allows remote attackers to bypass "Authorization checking" and obtain sensitive information from JSP pages via a crafted request. NOTE: this is probably a duplicate of CVE-2008-5412...

CVE-2008-4283: Improper Input Validation

CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server WAS 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2009-0436: Undefined Security Weakness

The 1 modibmssl and 2 modcgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server WAS, set incorrect permissions for AFUNIX sockets, which has unknown impact and local attack vectors...

CVE-2009-0434: Exposure of Sensitive Information to an Unauthorized Actor

PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server WAS 6.0.x before 6.0.2.31, 6.1.x before 6.1.0.21, and 7.0.x before 7.0.0.1, when Performance Monitoring Infrastructure PMI is enabled, allows local users to obtain sensitive information by reading the 1...

CVE-2009-0433: Undefined Security Weakness

Unspecified vulnerability in IBM WebSphere Application Server WAS 5.1.x before 5.1.1.19, 6.0.x before 6.0.2.29, and 6.1.x before 6.1.0.19, when Web Server plug-in content buffering is enabled, allows attackers to cause a denial of service daemon crash via unknown vectors, related to a mishandling...

CVE-2009-0432: Undefined Security Weakness

The installation process for the File Transfer servlet in the System Management/Repository component in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.19 does not enable the secure version, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2008-4284: Improper Link Resolution Before File Access

Open redirect vulnerability in the ibmsecuritylogout servlet in IBM WebSphere Application Server WAS 5.1.1.19 and earlier 5.x versions, 6.0.x before 6.0.2.33, and 6.1.x before 6.1.0.23 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the...

CVE-2009-0435: Undefined Security Weakness

Unspecified vulnerability in the IBM Asynchronous I/O aka AIO or libibmaio library in the Java Message Service JMS component in IBM WebSphere Application Server WAS 6.1.x before 6.1.0.17 on AIX 5.3 allows attackers to cause a denial of service daemon crash via vectors related to the aiogetioev2 a...

Code injection

Unspecified vulnerability in IBM WebSphere Application Server WAS 6.0.1 on z/OS allows attackers to read arbitrary files via unknown vectors...

CVE-2009-0391: Exposure of Sensitive Information to an Unauthorized Actor

Unspecified vulnerability in IBM WebSphere Application Server WAS 6.0.1 on z/OS allows attackers to read arbitrary files via unknown vectors...

Security feature bypass

Unspecified vulnerability in the Feature Pack for Web Services in the Web Services Security component in IBM WebSphere Application Server WAS 7 before 7.0.0.1 has unknown impact and attack vectors related to "userNameToken."...

CVE-2008-5413: Exposure of Sensitive Information to an Unauthorized Actor

PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server WAS 7 before 7.0.0.1 allows attackers to obtain sensitive information by reading the 1 systemout.log and 2 ffdc files. NOTE: this is probably a duplicate of CVE-2009-0434...