Security Bulletin: A Security Vulnerability in Websphere Application Server Affects Predictive Customer Intelligence

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about security vulnerabilities affecting Websphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin: Remote...

Oracle Mojarra JSF / Eclipse Mojarra JSF 2.2 / 2.3 Cross Site Scripting Vulnerability

Exploit for java platform in category web applications ======================================================================= title: Reflected Cross-Site Scripting XSS product: Oracle Mojarra JSF included in Java EE 7 Eclipse Mojarra JSF vulnerable version: 2.2 & 2.3 fixed version:...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Business Service Manager

Summary IBM WebSphere Application Server is shipped as a component of Tivoli Business Service Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the Security Bulletin: Remot...

CVE-2018-15206

CVE-2018-15206 affects BPC SmartVista 2 with a CSRF flaw exposed at SVFE2/pages/admpages/roles/createrole.jsf. CVSSv3 indicates HIGH impact (8.8) with network attack, low complexity, no privileges, but requires user interaction; confidentiality, integrity, and availability are rated HIGH. No reme...

Security Bulletin: Remote code execution vulnerability in the JSF used by WebSphere Application Server shipped with Tivoli Integrated Portal

Summary There is a remote code execution vulnerability in the JSF Sun Reference Implementation 1.2 used by WebSphere Application Server. The JSF Sun Reference Implementation 1.2 is used as the default in WebSphere Application Server v7.0. Vulnerability Details CVEID: Not Applicable DESCRIPTION:...

Programmers Who Don't Understand Security Are Poor at Security

A university study confirmed the obvious: if you pay a random bunch of freelance programmers a small amount of money to write security software, they're not going to do a very good job at it. In an experiment that involved 43 programmers hired via the Freelancer.com platform, University of Bonn...

Nuxeo Authentication Bypass and RCE Vulnerabilities

Nuxeo Platform is a cross-platform open source enterprise-class content management system CMS. An authentication bypass and RCE vulnerability exists in Nuxeo. The vulnerability is due to improper handling of facelet templates by the nuxeo-jsf-ui component, when accessing a facelet template does n...

Security Bulletin: Code execution vulnerability has been identified in WebSphere Application Server shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary The JavaServer Faces JSF application functionality in IBM WebSphere Application Server does not properly handle requests, which allows remote attackers to execute code. IBM WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Informati...

Security Bulletin: Remote code execution vulnerability in the JSF used by WebSphere Application Server shipped with Jazz for Service Management

Summary There is a remote code execution vulnerability in the JSF Sun Reference Implementation 1.2 used by WebSphere Application Server. The JSF Sun Reference Implementation 1.2 is used as the default in WebSphere Application Server v7.0, other versions it is not the default. Vulnerability Detail...

Cross-site Scripting (XSS)

webui-jsf is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on request.getRequestURI, allowing arbitrary scripts to be added into the URI and subsequently executed...

Security Bulletin: Security vulnerabilities have been identified in WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager

Summary WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Security vulnerabilities have been identified in the WebSphere Application Server where the RAM is deployed

Summary The JavaServer Faces JSF application functionality in IBM WebSphere Application Server does not properly handle requests, which allows remote attackers to execute code. Repeated attacks due to this vulnerability can result in exploiting the WebSphere Application Server. Vulnerability...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI

Summary Websphere Application Server WAS is shipped as a component of Tivoli Netcool/OMNIbus WebGUI. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Information disclosure in Remote code...

Security Bulletin: Remote code execution vulnerability in the JSF used by WebSphere Application Server

Summary There is a remote code execution vulnerability in the JSF Sun Reference Implementation 1.2 used by WebSphere Application Server. The JSF Sun Reference Implementation 1.2 is used as the default in WebSphere Application Server v7.0, other versions it is not the default. Vulnerability Detail...

The vulnerability of the JSF server component in WebLogic Server allows a perpetrator to gain unauthorized access to protected data or cause service failures.

The vulnerability of the WebLogic Server application server’s JSF component is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected data or cause service failures using the HTTP protocol...

Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Spring Framework Sample Apps subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker to takeover a WebLogic server. CVE-2018-1275 - ...

CVE-2018-2935

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: JSF. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

Design/Logic Flaw

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: JSF. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2018-2935

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: JSF. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2018-2935

CVE-2018-2935 is the Oracle WebLogic Server JSF vulnerability affecting 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. The issue allows an unauthenticated, network-accessible attacker via HTTP to compromise WebLogic Server, with human interaction required for exploitation (UI: REQUIRED). The impact i...