CVE-2009-1174

IBM WebSphere Application Server shows a vulnerability in its Web Services Security XML digital-signature handling. Affected products/versions: WebSphere Application Server 6.0.2 prior to 6.0.2.35 and 7.0 prior to 7.0.0.3. Root cause: an unspecified security problem in the XML digital-signature s...

CVE-2009-0855: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the administrative console in IBM WebSphere Application Server WAS 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0506

CVE-2009-0506 affects IBM WebSphere Application Server 5.1 and 6.0.2 before 6.0.2.33 on z/OS when CSIv2 Identity Assertion is enabled and EJB interaction occurs between a WAS 6.1 instance and a pre-6.1 instance. The vulnerability allows local users to cause an unknown impact via two vectors: (1) ...

CVE-2009-0504: Exposure of Sensitive Information to an Unauthorized Actor

WSPolicy in the Web Services component in IBM WebSphere Application Server WAS 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message...

CVE-2009-0433

CVE-2009-0433 affects IBM WebSphere Application Server (WAS) 5.1.x before 5.1.1.19, 6.0.x before 6.0.2.29, and 6.1.x before 6.1.0.19. The issue arises when the Web Server plug-in content buffering is enabled, due to mishandling of client read failures. This can cause a denial of service (daemon c...

CVE-2009-0437

CVE-2009-0437 affects the IBM WebSphere Application Server (WAS) 6.0.2 on Windows when WAS is registered as a Windows service. The vulnerability enables local users to obtain sensitive information by reading the logs/instconfigifwas6.log. The provided documents do not include exploitation details...

CVE-2008-4283

CVE-2008-4283 describes a CRLF injection vulnerability in the WebContainer component of IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.1.x versions. The issue allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via unspecified vectors. Accor...

CVE-2009-0435

IBM WebSphere Application Server 6.1.x on AIX 5.3 is affected by a denial-of-service vulnerability in the IBM JMS AIO/libibmaio library (aio_getioev2 and getEvent). The issue exists in WAS 6.1.x before 6.1.0.17 and can cause a daemon crash. Remediation: upgrade to WAS 6.1.0.17 or later Fix Pack t...

CVE-2009-0438: Undefined Security Weakness

IBM WebSphere Application Server WAS 7 before 7.0.0.1 on Windows allows remote attackers to bypass "Authorization checking" and obtain sensitive information from JSP pages via a crafted request. NOTE: this is probably a duplicate of CVE-2008-5412...

CVE-2009-0391

Technical details about CVE-2009-0391 (affected WAS component, root cause, exploit vectors or fixes) are not publicly available in the provided documents. Monitor for updates.

CVE-2009-0391: Exposure of Sensitive Information to an Unauthorized Actor

Unspecified vulnerability in IBM WebSphere Application Server WAS 6.0.1 on z/OS allows attackers to read arbitrary files via unknown vectors...

CVE-2008-5411

CVE-2008-5411 affects IBM WebSphere Application Server (WAS) 7 before 7.0.0.1, where SSL traffic is sent over unsecured TCP, enabling remote attackers to sniff and obtain sensitive information. Root cause: SSL data transmitted without proper protocol protection. Impact: confidentiality compromise...

CVE-2008-5413

CVE-2008-5413 affects IBM WebSphere Application Server (WAS): PerfServlet in the PMI/Performance Tools component allows a local attacker to read sensitive information from logs (systemout.log) and ffdc files. Affected line in the public description specifies WAS 7 before 7.0.0.1 (and related note...

CVE-2008-5414

IBM WebSphere Application Server 7.0 before Fix Pack 1 (i.e., before 7.0.0.1) is affected by a vulnerability in the Feature Pack for Web Services Web Services Security component related to the userNameToken, potentially enabling information disclosure. Connective sources (NVD/NVD-derived content ...

CVE-2008-5411: Undefined Security Weakness

IBM WebSphere Application Server WAS 7 before 7.0.0.1 sends SSL traffic over "unsecured TCP," which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

CVE-2008-5412: Undefined Security Weakness

Unspecified vulnerability in IBM WebSphere Application Server WAS 7 before 7.0.0.1 on Windows has unknown impact and attack vectors related to JSPs. NOTE: this is probably a duplicate of CVE-2009-0438...

CVE-2008-5414: Undefined Security Weakness

Unspecified vulnerability in the Feature Pack for Web Services in the Web Services Security component in IBM WebSphere Application Server WAS 7 before 7.0.0.1 has unknown impact and attack vectors related to "userNameToken."...

CVE-2008-5412

IBM WebSphere Application Server 7 (Windows) is affected by CVE-2008-5412/CVE-2009-0438, where WAS 7 before 7.0.0.1 allows remote attackers to bypass authorization and read sensitive data from JSPs via a crafted request. The issue is described as unspecified in the 2008 entry, with later sources ...

CVE-2008-4679

CVE-2008-4679 affects IBM WebSphere Application Server: Web Services Security in WAS 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19. When Certificate Store Collections uses CRLs, the code path does not call setRevocationEnabled on PKIXBuilderParameters, preventing revocation checks for X.509 certi...

CVE-2008-0740

IBM WebSphere Application Server (WAS) versions affected: 6.0.x before Fix Pack 25 (6.0.2.25) and 6.1 before Fix Pack 15 (6.1.0.15). The vulnerability involves writing unspecified cleartext information to http_plugin.log, which could enable local users to read and obtain sensitive data. There is ...