IBM WebSphere Application Server Sensitive Information Disclosure Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A security vulnerability exists in IBM WAS. A remote attacke...

CVE-2015-4938

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors...

CVE-2015-1932

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header...

Information disclosure

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors...

Design/Logic Flaw

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header...

CVE-2015-4938

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors...

CVE-2015-1932

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header...

CVE-2015-1932

CVE-2015-1932 affects IBM WebSphere Application Server and WebSphere Virtual Enterprise; versions affected include WAS 7.x prior to 7.0.0.39, WAS 8.0.x prior to 8.0.0.11, WAS 8.5.x prior to 8.5.5.7 and WebSphere Virtual Enterprise on WAS 7/8.0/8.5.0.x prior to respective fix packs. Root cause is ...

CVE-2015-4938

CVE-2015-4938 in IBM WebSphere Application Server could allow a remote attacker to spoof a servlet and persuade a user to enter sensitive information. Affected products/versions include WebSphere Application Server 7.0, 8.0, and 8.5.x (across Full/Li berty profiles and related bundles). The root ...

The vulnerability of WebSphere Application Server application servers allows a hacker to gain privileged access.

The vulnerability of WebSphere Application Server applications is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain privileged access by manipulating the value of the object...

The vulnerability of WebSphere Application Server for application servers allows attackers to increase their privileges.

The vulnerability of WebSphere Application Server applications is related to deficiencies in access control for certain functions. Exploiting this vulnerability can allow an attacker, operating locally, to increase their privileges due to errors in the configuration of access control rules...

CVE-2015-1946

IBM WebSphere Application Server WAS 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server WAS 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors...

CVE-2015-1927

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...

Default configuration

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...

Code injection

IBM WebSphere Application Server WAS 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server WAS 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors...

CVE-2015-1936

CVE-2015-1936 concerns IBM WebSphere Application Server Administrative Console session hijacking when Security is disabled. A remote authenticated attacker could exploit this to hijack another user’s session via the JSESSIONID parameter. Affected products/versions from the sources include WAS 8.0...

CVE-2015-1946

IBM WebSphere Application Server WAS 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server WAS 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors...

CVE-2015-1946

CVE-2015-1946 affects IBM WebSphere Application Server (WAS) and WebSphere Virtual Enterprise. It enables local privilege escalation due to incorrect handling of user roles, with vulnerable versions including WAS 8.5 prior to 8.5.5.6 and WAS 7.0/8.0 prior to their respective fixes; remediation is...

CVE-2015-1927

CVE-2015-1927 affects IBM WebSphere Application Server (and WAS bundled products). The root cause is a misconfigured WebContainer property, serveServletsByClassnameEnabled, which if not set correctly can allow a remote attacker to gain elevated privileges. Affected WAS versions include 7.0, 8.0, ...

CVE-2015-1927

The default configuration of IBM WebSphere Application Server WAS 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged acces...