IBM WebSphere Application Server and WebSphere Virtual Enterprise Information Disclosure Vulnerability

IBM WebSphere Application Server WAS and WebSphere Virtual Enterprise WVE are both products of IBM Corporation, U.S.A. WAS is an application server product; WVE is a set of application server virtualization solutions. There are security vulnerabilities in IBM WAS and WVE. A remote attacker could...

The vulnerability of WebSphere Application Server application servers allows a hacker to gain privileged access.

The vulnerability of WebSphere Application Server applications is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain privileged access by manipulating the value of the object...

The vulnerability of WebSphere Application Server for application servers allows attackers to increase their privileges.

The vulnerability of WebSphere Application Server applications is related to deficiencies in access control for certain functions. Exploiting this vulnerability can allow an attacker, operating locally, to increase their privileges due to errors in the configuration of access control rules...

Default configuration

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...

IBM WebSphere Application Server Session Hijacking Vulnerability

IBM WebSphere Application Server is an application server product that serves as a platform for Java EE and Web services applications and is the foundation of the IBM WebSphere software platform. A session hijacking vulnerability exists in IBM WebSphere Application Server, which allows remote...

IBM WebSphere Application Server Remote Elevation of Privilege Vulnerability (CNVD-2015-04409)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A remote boost vulnerability exists in IBM WAS. An attacker...

IBM WebSphere Application Server and WebSphere Virtual Enterprise Local Privilege Vulnerability

IBM WebSphere Application Server WAS and WebSphere Virtual Enterprise WVE are both products of IBM Corporation, U.S.A. WAS is an application server product; WVE is a set of application server virtualization solutions. The IBM WebSphere Application Server and WebSphere Virtual Enterprise local...

IBM Rational Requirements Composer and Rational DOORS Next Generation Local Elevation of Privilege Vulnerability

IBM Rational Requirements Composer and Rational DOORS Next Generation RDNG are requirements management solutions from IBM USA. When WebSphere Application Server and LTPA single sign-on used in IBM Rational Requirements Composer and RDNG are used together, the program fails to terminate the...

Design/Logic Flaw

IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation RDNG 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management RM session upon LTPA token...

CVE-2015-0121

IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation RDNG 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management RM session upon LTPA token...

CVE-2015-0121

CVE-2015-0121 affects IBM Rational Requirements Composer (RRC) versions 3.0–3.0.1.6 and 4.0–4.0.7, and Rational DOORS Next Generation (RDNG) 4.0–4.0.7 and 5.0–5.0.2. When WebSphere Application Server uses LTPA single sign-on, the RM session is not terminated after LTPA token expiration, allowing ...

IBM WebSphere Application Server Multiple Vulnerabilities

The IBM WebSphere Application Server running on the remote host is version 6.1.0.47 / 7.0.0.37 / 8.0.0.10 / 8.5.5.5 or prior. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the SNMP component due to improper handling of configuration...

Unspecified Arbitrary Code Execution Vulnerability in IBM WebSphere Application Server

IBM WebSphere Application Server is a commercial WEB application service program. An unspecified arbitrary code execution vulnerability exists in IBM WebSphere Application Server that allows an attacker to link to the management port and run a series of commands to execute arbitrary code...

IBM WebSphere Application Server (WAS) SNMP Implementation Sensitive Information Disclosure Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A security vulnerability exists in IBM WebSphere Application...

IBM WebSphere Application Server (WAS) elevation of privilege vulnerability (CNVD-2015-02799)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. An elevation of privilege vulnerability exists in IBM...

IBM WebSphere Application Server (WAS) elevation of privilege vulnerability (CNVD-2015-02800)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. An elevation of privilege vulnerability exists in IBM...

IBM WebSphere Application Server (WAS) elevation of privilege vulnerability (CNVD-2015-02806)

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. An elevation of privilege vulnerability exists in IBM...

CVE-2015-1885

WebSphereOauth20SP.ear in IBM WebSphere Application Server WAS 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vecto...

Design/Logic Flaw

WebSphereOauth20SP.ear in IBM WebSphere Application Server WAS 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vecto...

CVE-2015-0174

The CVE-2015-0174 issue affects IBM WebSphere Application Server (WAS) SNMP handling. The SNMP implementation in WAS 8.5 before 8.5.5.5 fails to properly handle configuration data, allowing remote authenticated users to obtain sensitive information via unspecified vectors. The connected IBM bulle...