The vulnerability of WebSphere Application Server application servers allows attackers to inject arbitrary Web or HTML code.

The vulnerability of the OpenID Connect client-side web application server provided by WebSphere Application Server exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using ...

Drupal 6.x < 6.36 OpenID Security Bypass

Binary data 9214.prm...

IBM WAS Liberty Profile OIDC Cross-Site Scripting Vulnerability

The IBM WebSphere Application Server WAS Liberty Profile is a dynamically assembled application server profile. A cross-site scripting vulnerability exists in IBM WebSphere Application Server WAS Liberty Profile versions prior to 8.5.5.9, OIDC Client Web Application, which can be exploited by...

CVE-2016-0283

Cross-site scripting XSS vulnerability in the OpenID Connect OIDC client web application in IBM WebSphere Application Server WAS Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2016-0283

Cross-site scripting XSS vulnerability in the OpenID Connect OIDC client web application in IBM WebSphere Application Server WAS Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in the OpenID Connect OIDC client web application in IBM WebSphere Application Server WAS Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2016-0283

CVE-2016-0283 affects IBM WebSphere Application Server Liberty Profile 8.5.5 before 8.5.5.9. The OpenID Connect (OIDC) client web application is vulnerable to cross-site scripting (XSS) via a crafted URL, enabling a remote attacker to inject web script or HTML in the victim’s browser. Impact per ...

CVE-2016-0283

Cross-site scripting XSS vulnerability in the OpenID Connect OIDC client web application in IBM WebSphere Application Server WAS Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Zend Framework < 1.12.4 Multiple Vulnerabilities

Binary data 9150.prm...

IBM WebSphere Application Server Multiple Vulnerabilities (swg21690185, swg21671835)

IBM WebSphere Application Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

IBM WebSphere Application Server Information Disclosure Vulnerability (swg21690185)

IBM WebSphere Application Server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ubiquiti Inc.: Auth bypass on directory.corp.ubnt.com

The researcher ebrietas demonstrated that access to our Internal corporate directory could be gained due to a misconfiguration in Google OpenID. This involved using a non-UBNT Google account and modification to the URL. The issue was resolved and the researcher was awarded a bounty for his...

JanRain PHP OpenID library security bypass vulnerability

JanRain PHP OpenID library is a U.S. JanRain company's OpenID library for PHP5 . The examples/consumer/common.php file in the JanRain PHP OpenID library fails to properly check for the 'openid.realm' parameter sent via the SERVERNAME element, allowing remote attackers to Modifying the Host HTTP...

CVE-2016-2049

examples/consumer/common.php in JanRain PHP OpenID library aka php-openid improperly checks the openid.realm parameter against the SERVERNAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted...

Design/Logic Flaw

examples/consumer/common.php in JanRain PHP OpenID library aka php-openid improperly checks the openid.realm parameter against the SERVERNAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted...

CVE-2016-2049

examples/consumer/common.php in JanRain PHP OpenID library aka php-openid improperly checks the openid.realm parameter against the SERVERNAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted...

UBUNTU-CVE-2016-2049

examples/consumer/common.php in JanRain PHP OpenID library aka php-openid improperly checks the openid.realm parameter against the SERVERNAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted...

CVE-2016-2049

The CVE-2016-2049 entry describes a vulnerability in the JanRain PHP OpenID library (php-openid), where examples/consumer/common.php improperly compares the openid.realm parameter to the SERVER_NAME value from the SERVER superglobal. This mismatch can allow remote attackers to hijack user authent...

CVE-2016-2049

examples/consumer/common.php in JanRain PHP OpenID library aka php-openid improperly checks the openid.realm parameter against the SERVERNAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted...

Mageia: Security Advisory (MGASA-2015-0253)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...