CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-1194
https://notcve.org/view.php?id=CVE-2017-1194
28 Apr 2017 — IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 123669. IBM WebSphere Application Server versiones 7.0, 8.0, 8.5 y 9.0 son vulnerables a falsificación de petición en sitios cruzados (CSRF) lo que podría permitir a un atacante ejecutar acciones malintencionadas y no autorizadas transmitidas a través de un usuario que c... • http://www.ibm.com/support/docview.wss?uid=swg22001226 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-1151
https://notcve.org/view.php?id=CVE-2017-1151
20 Mar 2017 — IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user to gain elevated privileges on the system. IBM Reference #: 1999293. IBM WebSphere Application Server 8.0, 8.5, 8.5.5 y 9.0 usando OpenID Connect (OIDC) configurado con un interceptor de asociación de confianza (TAI) podría permitir a un usuario obtener elevados privilegios en el sistema. IBM Reference #: 1999293. • http://www.ibm.com/support/docview.wss?uid=swg21999293 •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2017-1121
https://notcve.org/view.php?id=CVE-2017-1121
13 Feb 2017 — IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997743 IBM WebSphere Application Server 7.0, 8.0 y 9.0 es vulnerable a las secuencias de comandos en sitios cruzados. Esta vulnerabilidad permite a los usuarios integrar código JavaScript arbitrario en la inter... • http://www.ibm.com/support/docview.wss?uid=swg21997743 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2016-8919
https://notcve.org/view.php?id=CVE-2016-8919
01 Feb 2017 — IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources. IBM WebSphere Application Server puede ser vulnerable a una denegación de servicio, provocada al permitir que los objetos serializados de fuentes no fiables se ejecuten y causen el consumo de recursos. • http://www.ibm.com/support/docview.wss?uid=swg21993797 • CWE-399: Resource Management Errors •
CVSS: 5.4EPSS: 0%CPEs: 22EXPL: 0CVE-2016-8934
https://notcve.org/view.php?id=CVE-2016-8934
01 Feb 2017 — IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM WebSphere Application Server es vulnerable a las secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la IU Web alterando así la funcionalidad prevista que potencialmente ... • http://www.ibm.com/support/docview.wss?uid=swg21995995 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-0378
https://notcve.org/view.php?id=CVE-2016-0378
24 Nov 2016 — IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception. IBM WebSphere Application Server (WAS) Liberty en versiones anteriores a 16.0.0.3, cuando la instalación carece de una página de error predeterminada, permite a atacantes remotos obtener información sensible desencadenando una excepción. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI54459 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 13%CPEs: 136EXPL: 2CVE-2016-5983 – IBM WebSphere 7 / 8 / 8.5 / 9 Deserialization Issue
https://notcve.org/view.php?id=CVE-2016-5983
05 Oct 2016 — IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object. IBM WebSphere Application Server (WAS) 7.0 en versiones anteriores a 7.0.0.43, 8.0 en versiones anteriores a 8.0.0.13, 8.5 en versiones anteriores a 8.5.5.11, 9.0 en versiones anteriores a 9.0.0.2 y Liberty en versiones anteriores a 16.0.0.4 permite a usuarios rem... • https://packetstorm.news/files/id/139073 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 136EXPL: 0CVE-2016-5986
https://notcve.org/view.php?id=CVE-2016-5986
01 Oct 2016 — IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mishandles responses, which allows remote attackers to obtain sensitive information via unspecified vectors. IBM WebSphere Application Server (WAS) 7.x en versiones anteriores a 7.0.0.43, 8.0.x en versiones anteriores a 8.0.0.13, 8.5.x en versiones anteriores a 8.5.5.11, 9.0.x en versiones anteriores a 9.0.0.2 y Liberty en versiones anteriores a 16.0.0.3... • http://www-01.ibm.com/support/docview.wss?uid=swg1PI67093 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.5EPSS: 0%CPEs: 67EXPL: 0CVE-2016-0385
https://notcve.org/view.php?id=CVE-2016-0385
01 Sep 2016 — Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when HttpSessionIdReuse is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors. Desbordamiento de búfer en IBM WebSphere Application Server (WAS) 7.0 en versiones anteriores a 7.0.0.43, 8.0 en versiones anteriores a 8.0.0.13, 8.5 en versiones anteriores a 8.5.5.10, 9.0 en versiones anteriores a... • http://www-01.ibm.com/support/docview.wss?uid=swg1PI60026 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 67EXPL: 0CVE-2016-2960
https://notcve.org/view.php?id=CVE-2016-2960
08 Aug 2016 — IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and 9.0.0.x before 9.0.0.1 allows remote attackers to cause a denial of service via crafted SIP messages. IBM WebSphere Application Server (WAS) 7.x en versiones anteriores a 7.0.0.43, 8.0.0.x en versiones anteriores a 8.0.0.13, 8.5.0.x en versiones anteriores a 8.5.5.10, 8.5.0.x y 16.0.0.x Liberty en versiones anteriores a Liberty Fix P... • http://www-01.ibm.com/support/docview.wss?uid=swg1PI61548 • CWE-284: Improper Access Control •