PT-2011-3049

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions prior to 7.0.0.15 Description The issue is related to a memory leak in the JavaServer Pages JSP component. This memory leak occurs in the org.apache.jasper.runtime.JspWriterImpl.response and can be...

PT-2011-3046

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions prior to 7.0.0.15 Description A memory leak in the messaging engine allows remote attackers to cause a denial of service via network connections associated with a NULL return value from a synchronous J...

PT-2011-3048

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1.0.x through 6.1.0.36 IBM WebSphere Application Server versions 7.x through 7.0.0.14 Description A memory leak in the JavaServer Pages JSP component allows remote attackers to cause a denial of...

PT-2011-3043

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1.0.x through 6.1.0.30 IBM WebSphere Application Server versions 7.x through 7.0.0.14 Description The issue concerns the Administrative Console component in IBM WebSphere Application Server, where it...

PT-2011-3044

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1.0.x through 6.1.0.34 IBM WebSphere Application Server versions 7.x through 7.0.0.14 Description A double free issue allows remote backend IIOP servers to cause a denial of service, resulting in a...

PT-2011-3042

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions prior to 7.0.0.15 Description The issue arises when a J2EE 1.4 application is used in the Security component of IBM WebSphere Application Server. It incorrectly determines security role mapping based o...

PT-2011-3045

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions prior to 7.0.0.15 Description The issue allows remote attackers to cause a denial of service, resulting in a daemon hang, by performing close operations via network connections to a queue manager. This...

PT-2011-3047

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions prior to 7.0.0.15 Description The issue allows remote attackers to cause a denial of service, leading to worker thread exhaustion and UDP messaging outage, by sending many UDP messages. Recommendations...

PT-2011-3050

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 6.1.0.x through 6.1.0.34 IBM WebSphere Application Server versions 7.x through 7.0.0.14 Description The issue allows remote authenticated users to cause a denial of service by consuming memory, using a...

CVE-2011-1307: Undefined Security Weakness

The installer in IBM WebSphere Application Server WAS before 7.0.0.15 uses 777 permissions for a temporary log directory, which allows local users to have unintended access to log files via standard filesystem operations, a different vulnerability than CVE-2009-1173...

CVE-2011-1314: Undefined Security Weakness

The Service Integration Bus SIB messaging engine in IBM WebSphere Application Server WAS before 7.0.0.15 allows remote attackers to cause a denial of service daemon hang by performing close operations via network connections to a queue manager...

CVE-2011-1315: Undefined Security Weakness

Memory leak in the messaging engine in IBM WebSphere Application Server WAS before 7.0.0.15 allows remote attackers to cause a denial of service memory consumption via network connections associated with a NULL return value from a synchronous JMS receive call...

CVE-2011-1316: Undefined Security Weakness

The Session Initiation Protocol SIP Proxy in the HTTP Transport component in IBM WebSphere Application Server WAS before 7.0.0.15 allows remote attackers to cause a denial of service worker thread exhaustion and UDP messaging outage by sending many UDP messages...

CVE-2011-1313: Undefined Security Weakness

Double free vulnerability in IBM WebSphere Application Server WAS 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15 allows remote backend IIOP servers to cause a denial of service S0C4 ABEND and storage corruption by rejecting IIOP requests at opportunistic time instants, as demonstrated by request...

CVE-2011-1310: Exposure of Sensitive Information to an Unauthorized Actor

The Administrative Scripting Tools component in IBM WebSphere Application Server WAS 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15, when tracing is enabled, places wsadmin command parameters into the 1 wsadmin.traceout and 2 trace.log files, which allows local users to obtain potentially...

CVE-2011-1311: Undefined Security Weakness

The Security component in IBM WebSphere Application Server WAS before 7.0.0.15, when a J2EE 1.4 application is used, determines the security role mapping on the basis of the ibm-application-bnd.xml file instead of the intended ibm-application-bnd.xmi file, which might allow remote authenticated...

CVE-2011-1322: Undefined Security Weakness

The SOAP with Attachments API for Java SAAJ implementation in the Web Services component in IBM WebSphere Application Server WAS 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 allows remote attackers to cause a denial of service memory consumption via encrypted SOAP messages...

CVE-2011-1308: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Installation Verification Test IVT application in the Install component in IBM WebSphere Application Server WAS before 7.0.0.15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-1312: Undefined Security Weakness

The Administrative Console component in IBM WebSphere Application Server WAS 6.1.0.x before 6.1.0.31 and 7.x before 7.0.0.15 does not prevent modifications of the primary admin id, which allows remote authenticated administrators to bypass intended access restrictions by mapping a 1 user or 2 gro...

CVE-2011-1321: Undefined Security Weakness

The AuthCache purge implementation in the Security component in IBM WebSphere Application Server WAS 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 does not purge a user from the PlatformCredential cache, which might allow remote authenticated users to gain privileges by leveraging a group...