CVE-2009-1174

The Web Services Security component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.35 and 7.0 before 7.0.0.3 has an unspecified "security problem" in the XML digital-signature specification, which has unknown impact and attack vectors...

Design/Logic Flaw

The administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout...

CVE-2009-1173

IBM WebSphere Application Server 7.0 prior to 7.0.0.3 is affected by a permissions issue where files associated with interim fixes use 777 instead of the intended 755. This weak permission set could allow an attacker to modify these files and potentially impact the environment where the interim f...

CVE-2009-1172

CVE-2009-1172 affects IBM WebSphere Application Server (WAS). The JAX-RPC WS-Security runtime in WAS 6.1 before 6.1.0.23 and WAS 7.0 before 7.0.0.3, with APAR PK41002 installed, does not properly validate UsernameToken objects. The initial description notes impact as unknown and does not provide ...

CVE-2009-1174

IBM WebSphere Application Server shows a vulnerability in its Web Services Security XML digital-signature handling. Affected products/versions: WebSphere Application Server 6.0.2 prior to 6.0.2.35 and 7.0 prior to 7.0.0.3. Root cause: an unspecified security problem in the XML digital-signature s...

CVE-2009-1173

IBM WebSphere Application Server WAS 7.0 before 7.0.0.3 uses weak permissions 777 for files associated with unspecified "interim fixes," which allows attackers to modify files that would not have been accessible if the intended 755 permissions were used...

CVE-2009-1174

The Web Services Security component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.35 and 7.0 before 7.0.0.3 has an unspecified "security problem" in the XML digital-signature specification, which has unknown impact and attack vectors...

CVE-2009-0892

The CVE concerns IBM WebSphere Application Server admin console: WAS 6.1 before 6.1.0.23 and WAS 7.0 before 7.0.0.3 allow attackers to hijack user sessions in specific scenarios related to a forced logout. Affected components are the administrative console on those releases; the root cause is des...

CVE-2009-0891

The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 7.0.0.1, 6.1 before Fix Pack 23 6.1.0.23,and 6.0.2 before Fix Pack 33 6.0.2.33 does not properly enforce 1 nonce and 2 timestamp expiration values in WS-Security bindings as stored in the...

CVE-2009-0508

The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server WAS 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in 1 web-inf, 2 meta-inf, and unspecified other...

CVE-2009-0508

IBM WebSphere Application Server (WAS) is affected by CVE-2009-0508. Affected versions include WAS 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3. The vulnerability allows remote attackers to read arbitrary files contained in WAR archives (notably in web-inf a...

Microsoft Windows Invalid Pointer Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successfully exploiting this issue will result in the complete compromise of affected...

Microsoft Windows WINS Server WPAD and ISATAP Access Validation Vulnerability

Description The Microsoft Windows WINS Server is prone to an access-validation vulnerability because the software fails to properly restrict access when defining WPAD Web Proxy Autodiscovery Protocol and ISATAP Intra-Site Automatic Tunnel Addressing Protocol entries. An authenticated attacker may...

Microsoft Windows Kernel Handle Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. An attacker can exploit this issue to execute arbitrary code with kernel-level privileges. Successfully exploiting this issue will result in the complete compromise of affected...

Microsoft Windows DNS Server WPAD Access Validation Vulnerability

Description The Microsoft Windows DNS Server is prone to an access-validation vulnerability because the software fails to properly restrict access when defining WPAD Web Proxy Autodiscovery Protocol entries. An authenticated attacker may exploit this issue to create a WPAD DNS entry. This may aid...

Microsoft Windows Kernel GDI EMF/WMF Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can exploit this issue by enticing an unsuspecting victim to open a malicious EMF or WMF image file. Successfully exploiting this issue will allow attackers to execute arbitrary code with kernel-level...

CVE-2009-0856

Multiple cross-site scripting XSS vulnerabilities in sample applications in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.35, and 6.1 before 6.1.0.23 on z/OS, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0855

CVE-2009-0855 is an XSS vulnerability in IBM WebSphere Application Server 6.1, affecting the administrative console on z/OS before 6.1.0.23. The flaw allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected versions are 6.1.0.0 through 6.1.0.22; remediation...

PT-2009-3447 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server WAS versions 6.1.0.0 through 6.1.0.22 Description: A cross-site scripting XSS issue exists in the administrative console, allowing remote attackers to inject arbitrary web script or HTML. This could potentiall...

IBM Websphere Application Server 6.17.0 - Administrative Console Cross-Site Scripting

IBM Websphere Application Server 6.17.0 - Administrative Console Cross-Site Scripting source: https://www.securityfocus.com/bid/34001/info IBM WebSphere Application Server WAS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker m...