Code injection

IBM WebSphere Portal 6.0.0.x through 6.0.0.1, 6.0.1.x through 6.0.1.7, 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x through 7.0.0.2 CF26, and 8.0.0.x through 8.0.0.1 CF08 allows remote attackers to obtain sensitive Java Content Repository JCR information via a modified Web...

Information disclosure

IBM WebSphere Portal 8.0.0.1 before CF09 does not properly handle references in compute="always" Web Content Manager WCM navigator components, which allows remote attackers to obtain sensitive component information via unspecified vectors...

Design/Logic Flaw

IBM WebSphere Portal 7.0.0.x before 7.0.0.2 CF26 and 8.0.0.x before 8.0.0.1 CF09 does not properly handle content-selection changes during Taxonomy component rendering, which allows remote attackers to obtain sensitive property information in opportunistic circumstances by leveraging an error in ...

CVE-2013-6316

Technical details about CVE-2013-6316 are not publicly provided in the supplied documents; no concrete exploit data or affected product specifics beyond the generic description. Monitor for updates.

CVE-2013-6735

CVE-2013-6735 affects IBM Web Content Manager (WCM). The connected sources confirm an XPath-injection vulnerability in WCM LIBRARY parameter that allows an unauthenticated attacker to manipulate requests and potentially extract sensitive configuration/JCR data from vulnerable WCM installations (v...

CVE-2013-6723

IBM WebSphere Portal 8.0.0.1 before CF09 does not properly handle references in compute="always" Web Content Manager WCM navigator components, which allows remote attackers to obtain sensitive component information via unspecified vectors...

TRS WCM 6.5 /wcm/services/trs:templateservicefacade 任意文件创建漏洞

No description provided by source...

TRS某些版本WCM5.2~WCM6.5?存在SQL注入

简要描述： TRS某些版本WCM5.2WCM6.5?存在SQL注入，具体版本没测试，网上测试几个都存在。 不用登陆。 详细说明： 首先是这个页面，好像是越权了 http://agent.trs.cn/portal/db/dbupdateloglist.jsp 正常应该要登陆才能看吧？ 直接注入...

CVE-2010-4806

The authoring tool in IBM Web Content Manager WCM 6.1.5, and 7.0.0.1 before CF003, allows remote authenticated users to bypass intended access restrictions on draft creation by leveraging certain resource editor privileges...

CVE-2010-4807

CVE-2010-4807 affects IBM Web Content Manager (WCM) 7.0.0.1 before CF003. The issue is a race condition that allows remote authenticated users to trigger a denial of service via an infinite recursive query, linked to a StackOverflowError. Documents do not specify the exact vulnerable component, v...

CVE-2010-4806

The authoring tool in IBM Web Content Manager WCM 6.1.5, and 7.0.0.1 before CF003, allows remote authenticated users to bypass intended access restrictions on draft creation by leveraging certain resource editor privileges...

CVE-2010-4806

The CVE concerns IBM Web Content Manager (WCM) versions 6.1.5 and 7.0.0.1 before CF003. The underlying issue is a bypass of intended access restrictions on draft creation, achieved by remote authenticated users who leverage certain resource editor privileges. Affected component/process appears to...

CVE-2011-0679

Vulnerability (CVE-2011-0679) affects IBM WebSphere Portal 6.0.1.1 through 7.0.0.0, as deployed with IBM Lotus Web Content Management (WCM) and IBM Lotus Quickr for WebSphere Portal. The issue allows remote attackers to obtain sensitive information via a “modified message.” The NVD entry confirms...

Hacktics Advisory Feb10: XSS in IBM WebSphere Portal & Lotus WCM

Hacktics Research Group Security Advisory http://www.hacktics.com/view=Resources7CAdvisory By Oren Hafif, Hacktics. 24-Feb-2010 =========== I. Overview =========== During a penetration test performed by Hacktics' experts, certain vulnerabilities were identified in an IBM Websphere Portal Server a...

Cross site scripting

Cross-site scripting XSS vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management WCM, and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr...

CVE-2010-0715

Open redirect vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management WCM, and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0...

Open redirect

Open redirect vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management WCM, and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0...

CVE-2010-0715

CVE-2010-0715 is an open redirect vulnerability in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management, covering versions 5.1.0.0–5.1.0.5, 6.0.0.0–6.0.0.4, 6.0.1.0–6.0.1.7, 6.1.0.0–6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8....

CVE-2010-0714

CVE-2010-0714 describes a Cross-site scripting (XSS) vulnerability in login.jsp across IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), IBM Lotus Workplace WCM versions 5.1.x, 6.x, 6.1.x, 6.1.5.0, and IBM Lotus Quickr services for WebSphere Portal. The flaw allows remote attackers to...

IBM WebSphere Portal Server & Lotus WCM XSS Vulnerability

Exploit for unknown platform in category web applications ========================================================= IBM WebSphere Portal Server & Lotus WCM XSS Vulnerability ========================================================= =========== I. Overview =========== During a penetration test...