PT-2016-2311

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 Description The issue is related to the absence of the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie. This...

CVE-2016-2923: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified JAX-RS API cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script acces...

The vulnerability of WebSphere Application Server application servers allows attackers to execute arbitrary code.

The vulnerability of WebSphere Application Server application servers is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially crafted sequence of instructions sent to the management port...

The vulnerability of the WebSphere Application Server software allows a malicious intruder to compromise the confidentiality of protected information.

The vulnerability in Proxy and ODR servers of IBM WebSphere Application Server allows a malicious actor in the network to access confidential information. This vulnerability is related to the improper processing of requests...

The vulnerability of the WebSphere Application Server software allows a malicious intruder to compromise the integrity of protected information.

Cross-site scripting XSS in the IBM WebSphere Application Server administrative console allows authorized administrators who have passed authentication to inject any web script or HTML code using a specially crafted URL address...

The vulnerability of the WebSphere Application Server software allows a malicious attacker to compromise the accessibility of protected information.

The vulnerability in the XML4J processor of IBM WebSphere Message Broker and IBM Integration Bus allows malicious actors to trigger a service failure excessive memory consumption by using a specially crafted XML document that causes a large number of entities to be processed excessively...

The vulnerability of the WebSphere Application Server software allows a malicious intruder to compromise the confidentiality of protected information.

The IBM WebSphere Application Server program contains a vulnerability in its security profiles, which allows a malicious attacker to gain access to protected information by manipulating URL requests...

The vulnerability of the WebSphere Application Server software allows a malicious attacker to compromise the accessibility of protected information.

The vulnerability in the IBM Global Security Kit GSKit allows malicious actors to induce a service failure by using a specially crafted handshake during the reestablishment of an SSLv2 session...

IBM WebSphere Application Server CRLF Injection Vulnerability (swg21982526)

IBM WebSphere Application Server is prone to a CRLF injection vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-0359: Undefined Security Weakness

CRLF injection vulnerability in IBM WebSphere Application Server WAS 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 Full before 8.5.5.10, and 8.5 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a...

PT-2016-2328

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 7.0.0.42 IBM WebSphere Application Server versions 8.0 through 8.0.0.12 IBM WebSphere Application Server 8.5 Full versions prior to 8.5.5.10 IBM WebSphere Application Server 8.5 Liberty...

IBM WebSphere Application Server HTTP Response Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. There is a security vulnerability in IBM WAS. A remote...

IBM WebSphere Application Server Privilege Acquisition Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. Liberty Profile is a dynamic server profile for WAS. A privilege acquisition vulnerability exists in IBM WAS Liberty Profile version 8.5.5, which can be exploited to gain user...

CVE-2016-0306

IBM WebSphere Application Server WAS 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

CVE-2016-0306: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

PT-2016-4137

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 7.0 through 7.0.0.40 IBM WebSphere Application Server WAS versions 8.0 through 8.0.0.12 IBM WebSphere Application Server WAS versions 8.5 through 8.5.5.9 Description The issue is related to a...

The vulnerability of WebSphere Application Server application servers allows attackers to inject arbitrary Web or HTML code.

The vulnerability of the OpenID Connect client-side web application server provided by WebSphere Application Server exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using ...

IBM WebSphere Application Server Information Disclosure Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A security vulnerability exists in IBM WebSphere Application...

IBM WebSphere Application Server Privilege Escalation Vulnerability (Apr 2016)

IBM WebSphere Application Server is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2016-1600

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS Liberty Profile versions 8.5.5 through 8.5.5.8 Description A cross-site scripting XSS issue exists in the OpenID Connect OIDC client web application, allowing remote attackers to inject arbitrary web script...