CVE-2013-0542

CVE-2013-0542 (XSS in IBM WebSphere Application Server Admin Console) affects IBM WAS 6.1 (pre-6.1.0.47), 7.0 (pre-7.0.0.29), 8.0 (pre-8.0.0.6), and 8.5 (pre-8.5.0.2). A remote attacker can inject arbitrary script/HTML via crafted input in Admin Console fields, leading to potential user session h...

CVE-2013-1168

CVE-2013-1168 affects Cisco Unified MeetingPlace Application Server. The web server components for 7.x (before 7.1MR1 Patch 2), 8.0 (before 8.0MR1 Patch 1), and 8.5 (before 8.5MR3 Patch 1) fail to invalidate a user session on logout, enabling potential session hijacking through knowledge of a val...

CVE-2012-3304

Summary of the CVEs (IBM WebSphere Application Server family, 2012 vintage): Multiple flaws across WAS versions 6.1, 7.0, 8.0, and 8.5 allow remote or local attackers to hijack sessions (CVE-2012-3304), traverse directories (CVE-2012-3305, PM62467), bypass security restrictions via Federated Repo...

CVE-2012-2190

The provided connected sources confirm CVE-2012-2190 (TLS ClientHello crafted message causing DoS/daemon crash), CVE-2012-2191 (Vaudenay SSL CBC timing issue), and CVE-2012-2203 (PKCS#12 without integrity) involve IBM GSKit in multiple IBM products (WebSphere Application Server/IBM HTTP Server, I...

CVE-2012-2170

CVE-2012-2170 - IBM WebSphere Application Server (7.x) Affects IBM WebSphere Application Server 7.x prior to 7.0.0.23. The vulnerability stems from the Application Snoop Servlet not properly restricting access, enabling remote attackers to obtain sensitive client and request information via a dir...

CVE-2009-2748

IBM WebSphere Application Server Admin Console is affected by CVE-2009-2748: a cross-site scripting (XSS) vulnerability in the Administration Console for WAS 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Acc...

CVE-2011-3559

Unspecified vulnerability in Oracle Communications Server 2.0; GlassFish Enterprise Server 2.1.1, 3.0.1, and 3.1.1; and Sun Java System App Server 8.1 and 8.2 allows remote attackers to affect availability via unknown vectors related to Web Container...

Design/Logic Flaw

Unspecified vulnerability in Oracle Communications Server 2.0; GlassFish Enterprise Server 2.1.1, 3.0.1, and 3.1.1; and Sun Java System App Server 8.1 and 8.2 allows remote attackers to affect availability via unknown vectors related to Web Container...

CVE-2011-3559

Unspecified vulnerability in Oracle Communications Server 2.0; GlassFish Enterprise Server 2.1.1, 3.0.1, and 3.1.1; and Sun Java System App Server 8.1 and 8.2 allows remote attackers to affect availability via unknown vectors related to Web Container...

CVE-2011-3559

CVE-2011-3559 : Open vulnerability affecting Oracle GlassFish Server/Web Container components. Multiple Nessus/OpenVAS entries describe an unspecified DoS vulnerability in GlassFish/Web Container that could affect availability, with affected versions including GlassFish 2.1.1 (up to 2.1.1.14), 3....

CVE-2011-1355

Open redirect vulnerability in IBM WebSphere Application Server WAS 6.1 before 6.1.0.39 and 7.0 before 7.0.0.19 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage parameter...

CVE-2010-3271

CVE-2010-3271 : IBM WebSphere Application Server (ISC admin console) is vulnerable to multiple CSRF flaws in 7.0.0.13 and earlier. The issues arise where POST requests to adminSecurityDetail.do (Edit) and then to syncworkspace.do (Save) can be forged to hijack an administrator’s session and disab...

Oracle Application Server Authentication Bypass Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle GlassFish Application Server and Oracle Java Application Server. Authentication is not required to exploit this vulnerability. The flaw exists within the Web Administration component which...

CVE-2011-1309

Summary: CVE-2011-1309 affects IBM WebSphere Application Server (WAS) 7.x prior to 7.0.0.15, where the Plug-in component does not properly handle trace requests. The impact is described as unspecified in the sources; no explicit exploitation details are provided. The issue is linked to multiple v...

CVE-2008-7274

CVE-2008-7274 affects IBM WebSphere Application Server 6.1.0.9 when JAAS Login is enabled, allowing an internal hashtable login if a password is omitted or left empty. Impact per sources: authentication bypass with I (partial) integrity impact, network vector, no confidentiality/a‑vailable impact...

CVE-2011-0315

IBM WebSphere Application Server (WAS) is affected by a cross-site scripting (XSS) vulnerability in the Servlet Engine/Web Container component. The issue affects WAS 6.1 prior to 6.1.0.35 and WAS 7.0 prior to 7.0.0.15, enabling remote attackers to inject arbitrary web script or HTML through vecto...

CVE-2010-0783

CVE-2010-0783 is an XSS vulnerability in the Administrative Console of IBM WebSphere Application Server (WAS). The affected products are IBM WebSphere Application Server 6.1 before 6.1.0.35 and 7.0 before 7.0.0.13. The vulnerability allows remote attackers to inject arbitrary web script or HTML v...

CVE-2010-0784

IBM WebSphere Application Server 7.x is affected by a cross-site scripting (XSS) vulnerability in the Administrative Console prior to 7.0.0.13. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. OpenVAS entries corroborate multiple vulnerabilities fo...

CVE-2010-0777

CVE-2010-0777 affects IBM WebSphere Application Server Web Container. The issue arises from improper handling of long filenames, which can cause responses to include an incorrect file and disclose sensitive information. Affected products/versions: WAS 6.0 prior to 6.0.2.43, WAS 6.1 prior to 6.1.0...

CVE-2009-3106

CVE-2009-3106 affects IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.37. The Servlet Engine/Web Container fails to properly enforce security constraints on the doGet and doTrace methods, allowing remote attackers to bypass access restrictions and potentially obtain sensitive informatio...