CVE-2020-4782

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2020-4782

CVE-2020-4782 affects IBM WebSphere Application Server (WAS) 7.0, 8.0, 8.5 and 9.0. The vulnerability allows a remote attacker to traverse directories by sending a crafted URL with dot-dot sequences ("/../"), enabling viewing of arbitrary files on the system. IBM’s security bulletins (and related...

Vulnerability fixed in IBM WebSphere Application Server

A vulnerability has been fixed in IBM WebSphere Application Server. The vulnerability allows a remote malicious person to gain access to system data. IBM has released updates to fix the vulnerability. More information can be found on the page below: https://www.ibm.com/support/pages/node/6356083...

IBM WebSphere Application Server Path Traversal Vulnerability (CNVD-2020-59728)

IBM WebSphere Application Server WAS is an application server product from IBM in the United States. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A path traversal vulnerability exists in IBM WebSphere Application...

Security Bulletin: WebSphere Application Server Admin Console is vulnerable to a directory traversal vulnerability (CVE-2020-4782)

Summary WebSphere Application Server Admin Console is vulnerable to a directory traversal vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2020-4782 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to traverse directories on the system. An attack...

Security Bulletin: Vulnerability in Rational Developer for System z due to issues in IBM Java SDK (CVE-2013-0440, CVE-2013-0443, CVE-2013-0169)

Summary The version of IBM WebSphere Application Server that is shipped with Rational Developer for System z is shipped with an IBM Java SDK that is based on the Oracle SDK. Oracle has released February 2013 critical patch updates CPU which contain security vulnerability fixes and the IBM Java SD...

Security Bulletin: WebSphere Application Server - Oracle CPU shipped with Rational Developer for System z June 2013 (CVE-2013-1571)

Summary The IBM WebSphere Application Server shipped in Rational Developer for System z Software includes an IBM Java SDK that is based on the Oracle JDK. Oracle has released June 2013 critical patch updates CPU which contain security vulnerability fixes and the IBM Java SDK has been updated to...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2020-4576)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2020-4629)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

IBM WebSphere Application Server 9.0.x < 9.0.0.9 MITM (CVE-2018-8039)

The IBM WebSphere Application Server running on the remote host is version 9.0.x prior to 9.0.0.9. It is, therefore, affected by a man-in-the-middle MITM vulnerability in the Apache CXF sub-component due to the TLS hostname verification not working correctly with the com.sun.net.ssl interface. A...

IBM WebSphere Application Server 6.1.0.x < 6.1.0.47 / 7.0.0.x < 7.0.0.31 / 8.0.0.x < 8.0.0.7 / 8.5.x < 8.5.5.1 Clickjacking (CVE-2013-1571)

The IBM WebSphere Application Server running on the remote host is version 6.1.0.x prior to 6.1.0.47, 7.0.0.x prior to 7.0.0.31, 8.0.0.x prior to 8.0.0.7, or 8.5.0.x prior to 8.5.5.1. It is, therefore, affected by a vulnerability in the HTML documentation generated by the Javadoc tool. An...

IBM WebSphere Application Server 7.0.0.x < 7.0.0.45 / 8.0.0.x < 8.0.0.14 / 8.5.x < 8.5.5.13 / 9.0.x < 9.0.0.5 HTTP Response Splitting (CVE-2017-1503)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.x through 7.0.0.43, 8.0.0.x prior to 8.0.0.14, 8.5.0.x prior to 8.5.5.13 or 9.0.x prior to 9.0.0.5. It is, therefore, affected by an HTTP response splitting vulnerability. An unauthenticated, remote attacker can...

IBM WebSphere Application Server 9.0.0.4 Weak Encryption (CVE-2017-1504)

The IBM WebSphere Application Server running on the remote host is version 9.0.0.4. It is, therefore, affected by a weakness in a new feature using the PasswordUtil command to enable AES password encryption. If this feature was used, passwords were not encrypted as expected, resulting in weaker...

IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.14 / 9.0.x < 9.0.0.8 Information Disclosure (CVE-2017-1743)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.0 through 7.0.0.45, 8.0.0.0 through 8.0.0.15, 8.5.0.x prior to 8.5.5.14, or 9.0.x prior to 9.0.0.8. It is, therefore, affected by an information disclosure vulnerability that allows a remote, authenticated attacker t...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with WebSphere Remote Server (CVE-2020-4589)

Summary WebSphere Application Server is shipped with WebSphere Remote Server. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

IBM WebSphere Application Server 8.0.0.x < 8.0.0.14 / 8.5.x < 8.5.5.12 / 9.0.x < 9.0.0.5 Weak Security Bindings (CVE-2017-1501)

The IBM WebSphere Application Server running on the remote host is version 8.0.0.x prior to 8.0.0.14, 8.5.0.x prior to 8.5.5.12 or 9.0.x prior to 9.0.0.5. It is, therefore, affected by a vulnerability in the web services security bindings settings. If cipher suites were changed in the web service...

IBM WebSphere Application Server 7.0.0.x < 7.0.0.43 / 8.0.0.x < 8.0.0.13 / 8.5.x < 8.5.5.11 / 9.0.x < 9.0.0.1 FileUpload DoS (CVE-2016-3092)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.x prior to 7.0.0.43, 8.0.0.x prior to 8.0.0.13, 8.5.0.x prior to 8.5.5.11 or 9.0.x prior to 9.0.0.1. It is, therefore, affected by a denial of service vulnerability in the Apache Commons FileUpload subcomponent. An...

IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.17 / 9.0.x < 9.0.5.2 Beanutils Vulnerability (CVE-2019-10086)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.0 through 7.0.0.45, 8.0.0.0 through 8.0.0.15, 8.5.0.x prior to 8.5.5.17, or 9.0.x prior to 9.0.5.2. It is, therefore, affected by a vulnerability in the Apache Commons Beanutils subcomponent. An unauthenticated, remo...

Security Bulletin: WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to remote code execution vulnerability (CVE-2020-4589)

Summary WebSphere Application Server is vulnerable to a remote code execution vulnerability. This has been addressed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- Jazz for Service...

Security Bulletin: IBM Jazz for Service Management (JazzSM) is affected with multiple vulnerabilities (CVE-2015-4852, CVE-2015-6420, CVE-2017-15708)

Summary Jazz for Service Management is affected with multiple vulnerabilities CVE-2015-4852, CVE-2015-6420, CVE-2017-15708 Vulnerability Details CVEID: CVE-2017-15708 DESCRIPTION: In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse...