CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2009-2093
https://notcve.org/view.php?id=CVE-2009-2093
SQL injection vulnerability in the console in IBM WebSphere Partner Gateway (WPG) Enterprise 6.0 before FP8, 6.1 before FP3, 6.1.1 before FP2, and 6.2 before FP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la consola en IBM WebSphere Partner Gateway (WPG) Enterprise v6.0 anteriores a FP8, v6.1 anteriores a FP3, v6.1.1 anteriores a FP2, y v6.2 anteriores FP1 permite a los usuarios remotos autenticados ejecutar arbitrariamente comandos SQL a través de vectores no especificados. • http://secunia.com/advisories/36295 http://www-01.ibm.com/support/docview.wss?uid=swg21382117 http://www-1.ibm.com/support/docview.wss?uid=swg1JR32386 http://www-1.ibm.com/support/docview.wss?uid=swg1JR32607 http://www-1.ibm.com/support/docview.wss?uid=swg1JR32608 http://www-1.ibm.com/support/docview.wss? • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 31EXPL: 0CVE-2009-2085
https://notcve.org/view.php?id=CVE-2009-2085
The Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of Identity Assertion with CSIv2 Security, which allows remote attackers to bypass intended CSIv2 access restrictions via vectors involving Enterprise JavaBeans (EJB). El componente Security en IBM WebSphere Application Server (WAS) v6.1 anterior a v6.1.0.25 y v7.0 anterior a v7.0.0.5 no maneja adecuadamente la Aserción de Identidad (Identity Assertion) con CSIv2 Security, lo que permite a atacantes remotos evitar las restricciones de acceso establecidas con CSIv2 a través de vectores que involucran la "Enterprise JavaBeans" (EJB). • http://www-01.ibm.com/support/docview.wss?uid=swg27007951 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www-1.ibm.com/support/docview.wss?uid=swg1PK83097 https://exchange.xforce.ibmcloud.com/vulnerabilities/52076 • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2009-2091
https://notcve.org/view.php?id=CVE-2009-2091
The System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 on z/OS uses weak file permissions for new applications, which allows remote attackers to obtain sensitive information via unspecified vectors. El componente System Management/Repository en IBM WebSphere Application Server (WAS) v7.0 anteriores a v7.0.0.5 en z/OS utiliza permisos de ficheros débiles para nuevas aplicaciones, lo que permite a los atacantes remotos obtener información sensible a través de vectores no especificados. • http://secunia.com/advisories/34461 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www-1.ibm.com/support/docview.wss?uid=swg1PK83308 http://www.securityfocus.com/bid/36157 https://exchange.xforce.ibmcloud.com/vulnerabilities/52083 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 31EXPL: 0CVE-2009-2088
https://notcve.org/view.php?id=CVE-2009-2088
The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on (SSO) and disableSecurityPreInvokeOnFilters are configured, allows remote attackers to bypass authentication via a request for a "secure URL," related to a certain invokefilterscompatibility property. El componente Servlet Engine/Web Container en IBM WebSphere Application Server (WAS) v6.1 anterior a v6.1.0.25 y v7.0 anterior a v7.0.0.5, cuando SPNEGO Single Sign-on (SSO) y disableSecurityPreInvokeOnFilters son configurados, permite a los atacantes remotos evitar la autenticación a través de una petición a una "URL segura", relativa a cierta propiedad invokefilterscompatibility. • http://www-01.ibm.com/support/docview.wss?uid=swg24022479 http://www-01.ibm.com/support/docview.wss?uid=swg27007951 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www-1.ibm.com/support/docview.wss?uid=swg1PK77465 https://exchange.xforce.ibmcloud.com/vulnerabilities/52079 • CWE-287: Improper Authentication •
CVSS: 2.1EPSS: 0%CPEs: 31EXPL: 0CVE-2009-2089
https://notcve.org/view.php?id=CVE-2009-2089
The Migration component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when tracing is enabled and a 6.1 to 7.0 migration has occurred, allows remote authenticated users to obtain sensitive information by reading a Migration Trace file. El componente Migration en IBM WebSphere Application Server (WAS) v6.1 anteriores a v6.1.0.25 y v7.0 anteriores a v7.0.0.5, cuando cuando la traza está habilitada y una migración de 6.0 a 7.0 ha sucedido, lo que permite a los usuarios remotos autenticados obtener información sensible leyendo un archivo Migration Trace. • http://www-01.ibm.com/support/docview.wss?uid=swg27007951 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www-1.ibm.com/support/docview.wss?uid=swg1PK80337 http://www.securityfocus.com/bid/36156 https://exchange.xforce.ibmcloud.com/vulnerabilities/52081 • CWE-16: Configuration •