CVE-2014-3054

CVE-2014-3054 refers to multiple open redirects in the Unified Task List (UTL) Portlet of IBM WebSphere Portal 7.x and 8.x up to 8.0.0.1 CF12. The open redirect flaw could allow remote attackers to redirect users to arbitrary sites and potentially facilitate phishing via unspecified vectors. Conn...

CVE-2015-1887

CVE-2015-1887 affects IBM WebSphere Portal: information disclosure of JCR data via a crafted request due to improper access control on the JCR component. A remote, unauthenticated attacker could obtain sensitive information from the Java Content Repository. Affected versions per sources: WebSpher...

CVE-2015-1899

CVE-2015-1899 affects IBM WebSphere Portal 8.5 through CF05, enabling remote attackers to cause a denial of service via CPU resource consumption. The Nessus plugin for IBM WebSphere Portal 8.5.0

CVE-2013-0549

The CVE records a cross-site scripting vulnerability in IBM WebSphere Portal’s Web Content Viewer Portlet. Affected product: WebSphere Portal server (IBM Web Content Manager – Web Content Viewer Portlet). Vulnerable component: the Web Content Viewer Portlet when the IBM Portlet API is used. Root ...

CVE-2013-6723

CVE-2013-6723 affects IBM WebSphere Portal 8.0.0.1 before CF09. The issue arises from how references in compute="always" Web Content Manager (WCM) navigator components are handled, enabling remote attackers to obtain sensitive component information via unspecified vectors. Public records indicate...

CVE-2014-0901

CVE-2014-0901 is an XSS in the Social Rendering component of the IBM Connections integration within IBM WebSphere Portal 8.0.0.x before 8.0.0.1 CF11. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in the Social Rendering path. A ...

CVE-2014-0951

CVE-2014-0951 corresponds to a cross-site scripting (XSS) vulnerability in IBM WebSphere Portal’s FilterForm.jsp. The connected sources specify that WebSphere Portal 7.0 is affected before 7.0.0.2 CF28 and WebSphere Portal 8.0 is affected before 8.0.0.1 CF12, with exploitation possible through un...

CVE-2014-0952

CVE-2014-0952 is a cross-site scripting (XSS) vulnerability in IBM WebSphere Portal where boot_config.jsp accepts unsanitized input. Affected versions include WebSphere Portal 6.1.0.x up to 6.1.0.6 CF27, 6.1.5 up to 6.1.5.3 CF28, 7.0 up to 7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12. An attacker ca...

CVE-2015-7428

CVE-2015-7428 is an open redirect vulnerability in IBM WebSphere Portal. Affected products/versions: IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09. Root cause: improper validation of input in redirect logic, allowing remote attackers to redirect users to arbitrary s...

CVE-2013-5454

CVE-2013-5454 affects IBM WebSphere Portal versions 6.0–8.0 (specific CFs: 6.0.1.7, 6.1.0.6 CF27, 6.1.5.3 CF27, 7.0.0.2 CF25, 8.0.0.1 CF08). The vulnerability allows remote attackers to read arbitrary files by supplying a modified URL. No explicit root cause details or exploitation status are pro...

CVE-2013-6730

CVE-2013-6730 affects IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.0.x before 7.0.0.2 CF27, and 8.0.0.x before 8.0.0.1 CF10. When the wcm.path.traversal.security setting is enabled, remote attackers can bypass read restrictions by accessing restricted items...

CVE-2014-0828

CVE-2014-0828 is an XSS in IBM WebSphere Portal's Web Content Manager UI affecting WebSphere Portal 6.1.0.x (up to 6.1.0.6 CF27), 6.1.5.x (up to 6.1.5.3 CF27), 7.0.0.x (up to 7.0.0.2 CF27), and 8.0.0.x before 8.0.0.1 CF11. The root cause is insufficient input filtering in the WCM UI/Social Render...

CVE-2014-0953

IBM WebSphere Portal is affected by CVE-2014-0953, an XSS vulnerability across multiple versions (6.1.0.x, 6.1.5.x CF27, 7.0.0.x CF28, and 8.0.0 before 8.0.0.1 CF12) that allows remote attackers to inject arbitrary web script or HTML via a crafted URL. The connected entries explicitly identify th...

CVE-2014-0956

CVE-2014-0956 is an XSS vulnerability affecting IBM WebSphere Portal (versions 6.1.0.x up to 6.1.0.6 CF27; 6.1.5.x up to 6.1.5.3 CF27; 7.0.x up to 7.0.0.2 CF28; and 8.0 before 8.0.0.1 CF12) in the googlemap.jsp component. The issue allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2014-4760

CVE-2014-4760 is an open redirect vulnerability in IBM WebSphere Portal. The NVD entry lists affected versions: 6.1.0.0–6.1.0.6 CF27, 6.1.5.0–6.1.5.3 CF27, 7.0.0–7.0.0.2 CF28, 8.0.0 before 8.0.0.1 CF13, and 8.5.0 before CF01. A remote attacker can craft a URL to redirect users to arbitrary extern...

CVE-2014-6093

CVE-2014-6093 is an XSS vulnerability in IBM WebSphere Portal affecting 7.0.x before 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02. It allows remote authenticated users to inject arbitrary script or HTML via a crafted URL. No exploit details or remediation are provided in t...

CVE-2014-6215

CVE-2014-6215 is an XSS vulnerability in IBM WebSphere Portal. Versions affected include 6.1.0.x (up to 6.1.0.6 CF27), 6.1.5.x (up to 6.1.5.3 CF27), 7.0.0 before 7.0.0.2 CF29, 8.0.0 up to 8.0.0.1 CF14, and 8.5.0 before CF03. Root cause: improper validation of user-supplied input enables reflected...

CVE-2015-4998

CVE-2015-4998 affects IBM WebSphere Portal across multiple versions (6.1.0 up to CF08 of 8.5.0). The vulnerability is a Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML through a crafted URL. The available connected documents confirm the affected...

CVE-2015-7455

CVE-2015-7455 affects IBM WebSphere Portal versions 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09. The vulnerability is described as weak permissions on content items, enabling remote authenticated users to modify content via the authoring UI. Connected source...

CVE-2018-1483

CVE-2018-1483 affects IBM WebSphere Portal 8.5 and 9.0. It is a cross-site scripting vulnerability caused by improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can lure a user to click a crafted URL to execute arbitrary script in the user’...

CVE-2010-0704

CVE-2010-0704 is an XSS vulnerability in IBM WebSphere Portal 6.0.1.5 wp6015_008_01, specifically in the Portlet Palette search field. Remote attackers could inject arbitrary web script or HTML via the search field. The connected Red Hat and NVD entries corroborate the same description. The avail...

CVE-2010-1348

Technical details for CVE-2010-1348 are not publicly available in the provided documents; no concrete affected components, root-cause, impact, or remediation are described. Monitor for updates.

CVE-2014-0917

IBM Eclipse Help System (IEHS) is vulnerable to Cross-Site Scripting due to improper validation of user input in the IEHS HTML contents referenced by WebSphere Portal. A crafted URL can inject arbitrary JavaScript, affecting IEHS versions 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7....

CVE-2014-8902

IBM WebSphere Portal Blog Portlet is affected by a reflected cross-site scripting (XSS) vulnerability (CVE-2014-8902) in multiple versions: 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 through 8.0.0.1 CF14, and 8.5.0 before CF04. The issue allows remot...

CVE-2015-0139

CVE-2015-0139 is an XSS vulnerability in IBM WebSphere Portal. Affected versions: WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05. The issue allows remote authenticated users to inject arbitrary script/HTML via a crafted URL. The connected sources reiterate the same impact and d...

CVE-2016-0243

IBM WebSphere Portal is affected by a cross-site scripting vulnerability (CVE-2016-0243) due to improper validation of user-supplied input, allowing remote attackers to inject script via a crafted URL. Affected versions include WebSphere Portal 6.1.x (6.1.0.x to 6.1.0.6 CF27, 6.1.5.x to 6.1.5.3 C...

CVE-2016-2901

IBM WebSphere Portal 8.5 CF08–CF10 (and Web Content Manager) is affected by CVE-2016-2901 due to a CSRF/XSRF vulnerability in the PA_Theme_Creator. An unauthenticated remote attacker could exploit specially crafted requests to hijack the authentication of arbitrary users and perform actions that ...

CVE-2018-1444

CVE-2018-1444 affects IBM WebSphere Portal 8.5 and 9.0, where a cross-site scripting vulnerability arises from improper validation of user-supplied input. An unauthenticated remote attacker can entice a user to click a crafted URL to execute arbitrary script in the user’s browser, with potential ...

CVE-2012-2181

CVE-2012-2181 affects IBM WebSphere Portal, specifically the Dojo module. The vulnerability enables a remote, unauthenticated attacker to read arbitrary files by crafting the path parameter to layerLoader.jsp, due to improper validation in the Dojo toolkit. Affected: WebSphere Portal 7.0.0.1/7.0....

CVE-2014-0954

CVE-2014-0954 affects IBM WebSphere Portal versions 6.1.0.x (6.1.0.6 CF27 and 6.1.5.x CF27), 7.0.x (up to 7.0.0.2 CF28), and 8.0 prior to 8.0.0.1 CF12. The issue is that JSP includes are not validated, which can let remote attackers obtain sensitive information, bypass request-dispatcher access r...

CVE-2014-0958

IBM WebSphere Portal contains an open redirect vulnerability (CVE-2014-0958) affecting 6.1.0–6.1.0.6 CF27, 6.1.5–6.1.5.3 CF27, 7.0–7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12. The issue allows remote attackers to redirect users to arbitrary sites and conduct phishing via unspecified vectors. Exploi...

CVE-2014-3057

The CVE-2014-3057 entry affects IBM WebSphere Portal 7.x and 8.x (up to 8.0.0.1 CF12) via the Unified Task List (UTL) Portlet. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML through a crafted URL. Exploitation details, af...

CVE-2014-4792

CVE-2014-4792 affects IBM WebSphere Portal versions 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, 8.0.0 through 8.0.0.1 CF13, and 8.5.0 before CF02. It allows remote authenticated users to cause a denial of service (disk consumption) by uploading large files....

CVE-2014-8909

CVE-2014-8909 is an XSS vulnerability in IBM WebSphere Portal. Improper validation of user-supplied input allows remote authenticated users to inject arbitrary script or HTML via a crafted URL. Affected versions listed in the sources include WebSphere Portal 6.1.0.x (up to 6.1.0.6 CF27), 6.1.5.x ...

CVE-2015-7472

CVE-2015-7472 affects IBM WebSphere Portal across multiple versions (6.1.x, 7.0.x, 8.0.0 before 8.0.0.1, and 8.5.0 before CF10) via an LDAP injection vulnerability that allows remote attackers to read/write repository data through unspecified vectors. Other connected sources confirm LDAP injectio...

CVE-2017-1761

IBM WebSphere Portal versions 7.0, 8.0, 8.5 and 9.0 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. Source data from NVD/NVL-style entries co...

CVE-2011-2172

The CVE-2011-2172 entry describes a Cross-site scripting (XSS) vulnerability in the search center of IBM WebSphere Portal 7.0.0.1 before CF004, allowing remote attackers to inject arbitrary script/HTML via unspecified vectors. Affected product: IBM WebSphere Portal 7.0.0.1 (before CF004). Impact:...

CVE-2013-0587

IBM WebSphere Portal is affected by multiple cross-site scripting (XSS) vulnerabilities in versions prior to 8.0.0.1 CF07. The XSS vectors involve the Portal, Portal 7.0.0.2, Portal 8.0, and the PortalWeb2 theme, allowing remote attackers to inject arbitrary web script or HTML into a user’s brows...

CVE-2014-3056

CVE-2014-3056: Affected product is IBM WebSphere Portal Unified Task List (UTL) Portlet on WebSphere Portal 7.x and 8.x up to 8.0.0.1 CF12. The issue is information disclosure exposing environment variables and certain JAR versions via unspecified vectors. This is an information disclosure vulner...

CVE-2015-7413

CVE-2015-7413 is a cross-site scripting (XSS) vulnerability in IBM WebSphere Portal. The issue affects IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF19 and 8.5.0 through CF08, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. The vulnerability is a client-side inje...

CVE-2016-0209

CVE-2016-0209 affects IBM WebSphere Portal 8.5.0 up to before CF09, exposing a cross-site scripting (XSS) vulnerability via unspecified vectors. The OpenVAS entry corroborates a WebSphere Portal XSS issue; the explanation in the sources describes a vulnerability consistent with XSS but does not s...

CVE-2016-8922

Exphox WebRadar is affected by a cross-site scripting (XSS) vulnerability. The issue allows embedding arbitrary JavaScript in the Web UI, potentially altering functionality and leading to credentials disclosure within a trusted session. The vulnerability is documented in CVE-2016-8922 across mult...

CVE-2017-1423

IBM WebSphere Portal versions 8.5 and 9.0 expose backend server URLs that are configured for the Web Application Bridge component. This vulnerability (CVE-2017-1423) is an information-disclosure flaw triggered by the Web Application Bridge, leading to potential exposure of backend endpoints. It i...

CVE-2018-1716

CVE-2018-1716 affects IBM WebSphere Portal versions 7.0, 8.0, 8.5, and 9.0. The vulnerability is a cross-site scripting flaw that allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Documents consistently describe the impact...

CVE-2008-5675

Technical details are not publicly available in the provided documents; no concrete impact, vectors, or fixes are stated. Monitor for updates from official advisories.

CVE-2012-4834

IBM WebSphere Portal versions 7.0.0.1/7.0.0.2 before CF19 and 8.0 before CF03 are affected by CVE-2012-4834 via the theme component’s LayerLoader.jsp (Dojo module). An attacker can read arbitrary files by supplying a crafted path/URI parameter, due to inadequate validation in the Dojo layerLoader...

CVE-2014-0959

CVE-2014-0959 affects IBM WebSphere Portal 6.1.0–6.1.0.6 CF27, 6.1.5–6.1.5.3 CF27, 7.0–7.0.0.2 CF28, and 8.0 before 8.0.0.1 CF12. The vulnerability allows remote authenticated users to cause a denial of service (infinite loop) via a login redirect. Multiple sources (NVD, Tenable NASL) confirm the...

CVE-2014-6171

CVE-2014-6171 is an XSS flaw in IBM WebSphere Portal affecting 6.1.x, 7.0.x, 8.0.x, and 8.5.0 before CF04. The vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Connected documents do not provide exploitation specifics or patch/version remediation det...

CVE-2014-6214

IBM WebSphere Portal is affected by a CSRF/XSRF vulnerability in versions 8.0.0.x before 8.0.0.1 CF15 and 8.5.0 before CF05, allowing remote attackers to hijack user authentication for requests that insert XSS sequences. The issue stems from improper validation of user-supplied input, enabling au...

CVE-2015-1943

CVE-2015-1943 affects IBM WebSphere Portal 6.1.0.x (up to 6.1.0.6 CF27), 6.1.5.x (up to 6.1.5.3 CF27), 7.0.x (up to 7.0.0.2 CF29), 8.0.x (before 8.0.0.1 CF17), and 8.5.0 before CF06. The vulnerability allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted ...