FTP JCL Execution

Submit JCL to z/OS via FTP and SITE FILE=JES. This exploit requires valid credentials on the target system. Module Options msf use exploit/mainframe/ftp/ftp/jclcreds msf undefinedjclcreds show actions ...actions... msf undefinedjclcreds set ACTION msf undefinedjclcreds show options ...show and se...

IBM WebSphere Application Server 8.5 < Fix Pack 2 Multiple Vulnerabilities

IBM WebSphere Application Server 8.5 before Fix Pack 2 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities : - The included Java SDK contains several errors that affect the application directly. CVE-2013-0169, CVE-2013-0440,...

IBM WebSphere Application Server 8.0 < Fix Pack 6 Multiple Vulnerabilities

IBM WebSphere Application Server 8.0 before Fix Pack 6 appears to be running on the remote host. It is, therefore, potentially affected by the following vulnerabilities : - An input validation error exists that could allow cross-site request forgery CSRF attacks. CVE-2012-4853 / PM62920 - The...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Document Connect for Application Support Facility aka DC4ASF before 1.0.0.1218 in Application Support Facility ASF 3.4 for z/OS on Windows, Linux, and AIX allows remote authenticated users to inject content, and conduct phishing attacks, via unspecifi...

CVE-2013-0572

CVE-2013-0572 affects IBM Document Connect for Application Support Facility (DC4ASF) before 1.0.0.1218 in ASF 3.4 for z/OS, Windows, Linux, and AIX. The vulnerability is a cross-site scripting (XSS) issue that could allow remote authenticated users to inject content and conduct phishing attacks v...

CVE-2013-0490

Unspecified vulnerability in IBM InfoSphere Guardium S-TAP 8.1 for DB2 on z/OS allows local users to gain privileges via unknown vectors...

Code injection

Unspecified vulnerability in IBM InfoSphere Guardium S-TAP 8.1 for DB2 on z/OS allows local users to gain privileges via unknown vectors...

CVE-2013-0490

Unspecified vulnerability in IBM InfoSphere Guardium S-TAP 8.1 for DB2 on z/OS allows local users to gain privileges via unknown vectors...

CVE-2013-0490

CVE-2013-0490 is an IBM vulnerability with an unspecified local-privilege escalation affecting multiple IBM products. Confirmed affected components in the connected data include IBM TXSeries for Multiplatforms (CICS/7.1 on AIX) and IBM InfoSphere Guardium S-TAP for DB2 on z/OS (v8.1). Core issue ...

CVE-2012-5951

Unspecified vulnerability in IBM Tivoli NetView 1.4, 5.1 through 5.4, and 6.1 on z/OS allows local users to gain privileges by leveraging access to the normal Unix System Services USS security level...

Code injection

Unspecified vulnerability in IBM Tivoli NetView 1.4, 5.1 through 5.4, and 6.1 on z/OS allows local users to gain privileges by leveraging access to the normal Unix System Services USS security level...

CVE-2012-5951

CVE-2012-5951 affects IBM Tivoli NetView for z/OS (NetView vXrX in v5.1–5.4 and v6.1; 1.4) and enables local privilege escalation by abusing USS security level. Exploitation details in connected docs show: locate cnmeunix at /usr/lpp/netview/vXrX/bin/cnmeunix (vXrX ≥5.1 and ≤5.4 or =6.1) and run ...

IBM WebSphere Application Server for z/OS HTTP Server组件任意命令执行漏洞

BUGTRAQ ID: 57010 CVECAN ID: CVE-2012-5955 WebSphere是IBM的集成软件平台。它包含了编写、运行和监视全天候的工业强度的随需应变Web应用程序和跨平台、跨产品解决方案所需要的整个中间件基础设施，如服务器、服务和工具。 IBM WebSphere Application Server for z/OS 5.3及其他版本在HTTP服务器组件5.3版本内存在安全漏洞，可允许远程攻击者执行任意命令。 0 IBM Websphere Application Server 5.x 厂商补丁： IBM ---...

Code injection

Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server WAS for z/OS allows remote attackers to execute arbitrary commands via unknown vectors...

CVE-2012-5955

Technical details about CVE-2012-5955 are not publicly provided in the connected documents. Monitor for updates from IBM/NVD and vendors for affected versions, impact, and remediation.

CVE-2012-5955

Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server WAS for z/OS allows remote attackers to execute arbitrary commands via unknown vectors...

IBM WebSphere Application Server 6.1 < Fix Pack 45 Multiple Vulnerabilities

IBM WebSphere Application Server 6.1 before Fix Pack 45 appears to be running on the remote host. As such, it is potentially affected by the following vulnerabilities : - An error exists related to 'Application Snoop Servlet' and missing access controls. This error can allow sensitive information...

IBM WebSphere Application Server for z/OS CBIND检查绕过漏洞

CVE ID: CVE-2012-3311 IBM WebSphere Application Server WAS是由IBM遵照开放标准开发并发行的一种应用服务器。 IBM WebSphere Application Server for z/OS 8.5、8.0-8.0.0.4、7.0-7.0.0.23、6.1.0-6.1.0.43版本在执行CBIND检查时存在错误，成功利用后可绕过某些安全限制，访问或修改非法应用数据。 0 IBM Websphere Application Server 8.5.x IBM Websphere Application Server 8.0.x IB...

Design/Logic Flaw

IBM WebSphere Application Server WAS 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 on z/OS, in certain configurations involving Federated Repositories for IIOP connections and Optimized Local Adapters, does not perform CBIND checks, which allows local users ...

IBM WebSphere Application Server for z/OS JAX-RPC远程安全漏洞

BUGTRAQ ID: 52250 CVE ID: CVE-2012-0199 IBM WebSphere Application Server WAS是由IBM遵照开放标准，例如Java EE, XML 还有Web Services，开发并发行的一种应用服务器。与其兼容的Web服务器包括：Apache HTTP Server，Netscape Enterprise Server，Microsoft Internet Information Services IIS以及IBM HTTP Server。 IBM WebSphere Application Server for...