Page 10 of 110 results (0.013 seconds)

CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2016-9736

https://notcve.org/view.php?id=CVE-2016-9736

08 Jun 2017 — IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information. WebSphere Application Server de IBM usando peticiones SOAP malformadas podría permitir a un atacante remoto obtener información confidencial. • http://www-01.ibm.com/support/docview.wss?uid=swg21991469 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2017-1194

https://notcve.org/view.php?id=CVE-2017-1194

28 Apr 2017 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 123669. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0 son vulnerables a falsificación de petición en sitios cruzados (CSRF) lo que podría permitir a un atacante ejecutar acciones malintencionadas y no autorizadas transmitidas a través de un usuario que c... • http://www.ibm.com/support/docview.wss?uid=swg22001226 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0

CVE-2017-1151

https://notcve.org/view.php?id=CVE-2017-1151

20 Mar 2017 — IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user to gain elevated privileges on the system. IBM Reference #: 1999293. IBM WebSphere Application Server 8.0, 8.5, 8.5.5 y 9.0 usando OpenID Connect (OIDC) configurado con un interceptor de asociación de confianza (TAI) podría permitir a un usuario obtener elevados privilegios en el sistema. IBM Reference #: 1999293. • http://www.ibm.com/support/docview.wss?uid=swg21999293 •

CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0

CVE-2017-1121

https://notcve.org/view.php?id=CVE-2017-1121

13 Feb 2017 — IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997743 IBM WebSphere Application Server 7.0, 8.0 y 9.0 es vulnerable a las secuencias de comandos en sitios cruzados. Esta vulnerabilidad permite a los usuarios integrar código JavaScript arbitrario en la inter... • http://www.ibm.com/support/docview.wss?uid=swg21997743 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2016-8919

https://notcve.org/view.php?id=CVE-2016-8919

01 Feb 2017 — IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources. IBM WebSphere Application Server puede ser vulnerable a una denegación de servicio, provocada al permitir que los objetos serializados de fuentes no fiables se ejecuten y causen el consumo de recursos. • http://www.ibm.com/support/docview.wss?uid=swg21993797 • CWE-399: Resource Management Errors •

CVSS: 5.4EPSS: 0%CPEs: 22EXPL: 0

CVE-2016-8934

https://notcve.org/view.php?id=CVE-2016-8934

01 Feb 2017 — IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM WebSphere Application Server es vulnerable a las secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la IU Web alterando así la funcionalidad prevista que potencialmente ... • http://www.ibm.com/support/docview.wss?uid=swg21995995 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0

CVE-2016-9879 – Security: Improper handling of path parameters allows bypassing the security constraint

https://notcve.org/view.php?id=CVE-2016-9879

06 Jan 2017 — An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value retur... • http://www.securityfocus.com/bid/95142 • CWE-20: Improper Input Validation CWE-417: Communication Channel Errors •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2016-0378

https://notcve.org/view.php?id=CVE-2016-0378

24 Nov 2016 — IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception. IBM WebSphere Application Server (WAS) Liberty en versiones anteriores a 16.0.0.3, cuando la instalación carece de una página de error predeterminada, permite a atacantes remotos obtener información sensible desencadenando una excepción. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI54459 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 66EXPL: 0

CVE-2016-0377

https://notcve.org/view.php?id=CVE-2016-0377

22 Oct 2016 — The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors. La Administrative Console en IBM WebSphere Application Server (WAS) 7.x en versiones anteriores a 7.0.0.43, 8.0.x en versiones anteriores a 8.0.0.13 y 8.5.x en versiones anteriores a 8.5.5.10 no maneja correctamente las cookies CSRFtoken, lo que ... • http://www-01.ibm.com/support/docview.wss?uid=swg1PI56917 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.5EPSS: 1%CPEs: 136EXPL: 2

CVE-2016-5983 – IBM WebSphere 7 / 8 / 8.5 / 9 Deserialization Issue

https://notcve.org/view.php?id=CVE-2016-5983

05 Oct 2016 — IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object. IBM WebSphere Application Server (WAS) 7.0 en versiones anteriores a 7.0.0.43, 8.0 en versiones anteriores a 8.0.0.13, 8.5 en versiones anteriores a 8.5.5.11, 9.0 en versiones anteriores a 9.0.0.2 y Liberty en versiones anteriores a 16.0.0.4 permite a usuarios rem... • https://packetstorm.news/files/id/139073 • CWE-284: Improper Access Control •