10126 matches found
CVE-2013-0461
Cross-site scripting XSS vulnerability in the virtual member manager VMM administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecifi...
CVE-2013-0458
Cross-site scripting XSS vulnerability in the Administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2, when login security is disabled, allows remote attackers to inject arbitrary web script or HTML via...
CVE-2013-0462
Unspecified vulnerability in IBM WebSphere Application Server WAS 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors...
CVE-2013-0461
CVE-2013-0461 is an XSS in WebSphere Application Server's Virtual Member Manager (VMM) Administrative Console. Root cause: improper input validation in the administrative console, allowing a remote attacker to inject script via an error message. Affected versions (per IBM/DOC): WAS 6.1.0.46 and e...
CVE-2013-0462
Unspecified vulnerability in IBM WebSphere Application Server WAS 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors...
CVE-2013-0459
CVE-2013-0459 is an XSS vulnerability in the IBM WebSphere Application Server administrative console. The flaw allows remote attackers to inject arbitrary script/HTML via unspecified vectors. Affected versions include WAS 6.1 prior to 6.1.0.47, WAS 7.0 prior to 7.0.0.27, WAS 8.0 prior to 8.0.0.6,...
CVE-2013-0458
CVE-2013-0458 is an XSS in IBM WebSphere Application Server Administrative Console when login security is disabled. Affected products/versions: WAS 6.1 prior to 6.1.0.47, WAS 7.0 prior to 7.0.0.27, WAS 8.0 prior to 8.0.0.6, and WAS 8.5 prior to 8.5.0.2. Remediation per IBM advisories PM71139/PM71...
CVE-2013-0462
CVE-2013-0462 is an IBM WebSphere Application Server vulnerability (improper validation) that could allow an authenticated remote attacker to bypass security. It affects WAS 6.1, 7.0 (up to but not including 7.0.0.27), 8.0, and 8.5. IBM security advisories (PM76886/PM79937) provide fixes via Fix ...
CVE-2013-0461
Cross-site scripting XSS vulnerability in the virtual member manager VMM administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecifi...
CVE-2013-0460
CVE-2013-0460: IBM WebSphere Application Server contains a CSRF vulnerability in the portlet-based administrative console. An attacker could hijack user authentication and inject XSS sequences via requests to vulnerable portlets in WAS 6.1 up to 6.1.0.46 and 7.0 up to 7.0.0.26. Root cause: improp...
WebSphere Application Server (WAS) vulnerable to cross-site scripting
Overview WebSphere Application Server WAS provided by IBM contains a cross-site scripting vulnerability. WebSphere Application Server WAS provided by IBM contains a vulnerability in SnoopServlet, which may result in a cross-site scripting. Eiji James Yoshida of Security Professionals Network Inc...
JVN#24343509: WebSphere Application Server (WAS) vulnerable to cross-site scripting
WebSphere Application Server WAS provided by IBM contains a vulnerability in SnoopServlet, which may result in a cross-site scripting. Impact An arbitrary script may be executed on the user's web browser. Solution Apply a patch Apply the patch according to the information provided by the develope...
IBM WebSphere Application Server 7.0 < Fix Pack 27 Multiple Vulnerabilities
IBM WebSphere Application Server 7.0 before Fix Pack 27 appears to be running on the remote host. It is, therefore, potentially affected by the following vulnerabilities : - A request validation error exists related to the proxy server component that could allow a remote attacker to cause the pro...
JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing
twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments...
RHEL 4 : JBoss EAP (RHSA-2010:0376)
Updated JBoss Enterprise Application Platform JBEAP 4.2 packages that fix three security issues and multiple bugs are now available for Red Hat Enterprise Linux 4 as JBEAP 4.2.0.CP09. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability...
CVE-2012-1677
Technical details about CVE-2012-1677 are not publicly available in the provided documents. Monitor for updates from Oracle and CVE repositories for affected products, versions, and remediation.
Default application files available for download via the application server.
see: https://jira.atlassian.com/browse/JRA-31187 e.g. https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/ and https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/web.xml . FishEye shouldn't write any user data to the WEB-INF directory. The only files which are viewable there, should be the sam...
Default application files available for download via the application server.
see: https://jira.atlassian.com/browse/JRA-31187 e.g. https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/ and https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/web.xml . FishEye shouldn't write any user data to the WEB-INF directory. The only files which are viewable there, should be the sam...
IBM WebSphere Application Server for z/OS HTTP Server组件任意命令执行漏洞
BUGTRAQ ID: 57010 CVECAN ID: CVE-2012-5955 WebSphere是IBM的集成软件平台。它包含了编写、运行和监视全天候的工业强度的随需应变Web应用程序和跨平台、跨产品解决方案所需要的整个中间件基础设施，如服务器、服务和工具。 IBM WebSphere Application Server for z/OS 5.3及其他版本在HTTP服务器组件5.3版本内存在安全漏洞，可允许远程攻击者执行任意命令。 0 IBM Websphere Application Server 5.x 厂商补丁： IBM ---...