CVE-2001-0962

The CVE-2001-0962 entry concerns IBM WebSphere Application Server versions 3.02 through 3.53, where session IDs used in cookies are predictable. This predictability enables remote attackers to brute-force session IDs and gain privileges of WebSphere users. The documented impact is privilege escal...

CVE-2001-0319

The CVE-2001-0319 entry concerns IBM Net.Commerce 3.x, where the macro orderdspc.d2w in the report capability is vulnerable to SQL injection via the order_rn option. The underlying issue is a SQL injection flaw in the remote interface that lets an attacker supply crafted input to alter or execute...

CVE-2001-0446

CVE-2001-0446 affects IBM WCS (WebSphere Commerce Suite) 4.0.1 with Application Server 3.0.2. The issue enables remote attackers to read source code for *.jsp files by appending a "/" to the requested URL, exposing partial confidentiality (C:P/I:N/A:N; CVSS v2 base 5.0). No exploitation details a...

CVE-2009-2956

The CVE-2009-2956 entry relates to IBM WebSphere Commerce Suite, specifically the Net.Commerce and Net.Data components, which are reported to store sensitive information under the web root due to insufficient access control. This setup may allow remote attackers to discover passwords, and databas...