CVSS: 4.3EPSS: 0%CPEs: 47EXPL: 0CVE-2010-0783
https://notcve.org/view.php?id=CVE-2010-0783
Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la consola administrativa en IBM WebSphere Application Server (WAS) v6.1 anterio v6.1.0.35 y v7.0 anteior v7.0.0.13 permite a atacantes remotos inyecatar código web o HTML de su elección a través de vectores no especificados. • http://secunia.com/advisories/41722 http://secunia.com/advisories/42136 http://securitytracker.com/id?1024686 http://www-01.ibm.com/support/docview.wss?uid=swg1PM14251 http://www-01.ibm.com/support/docview.wss?uid=swg27004980 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www.osvdb.org/69007 https://exchange.xforce.ibmcloud.com/vulnerabilities/62947 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 20EXPL: 0CVE-2010-3700 – Spring Security Security Constraint Bypass
https://notcve.org/view.php?id=CVE-2010-3700
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter. VMware SpringSource Spring Security v2.x anterior a v2.0.6 y v3.x anterior a v3.0.4, y Acegi Security v1.0.0 hasta v1.0.7, como el usado en IBM WebSphere Application Server (WAS) v6.1 y v7.0, permite a los atacantes remotos evitar las restricciones de seguridad a través de un parámetro de ruta. Spring Security does not consider URL path parameters when processing security constraints. By adding an URL path parameter to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). • http://osvdb.org/68931 http://secunia.com/advisories/42024 http://www.securityfocus.com/archive/1/514517/100/0/threaded http://www.securityfocus.com/bid/44496 http://www.springsource.com/security/cve-2010-3700 https://issues.apache.org/bugzilla/show_bug.cgi?id=25015 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 1%CPEs: 33EXPL: 0CVE-2010-3186
https://notcve.org/view.php?id=CVE-2010-3186
IBM WebSphere Application Server (WAS) 7.x before 7.0.0.13, and WebSphere Application Server Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, when a JAX-WS application is used, does not properly handle an IncludeTimestamp setting in the WS-Security policy, which has unspecified impact and remote attack vectors. El servidor de aplicaciones IBM WebSphere (WAS) v7.x en versiones anteriores a la v7.0.0.13, y WebSphere Application Server Feature Pack para Web Services v6.1.0.9 hasta la v6.1.0.32, si se utiliza una aplicación JAX-WS, no maneja apropiadamente una opción de configuración IncludeTimestamp en la política WS-Security, lo que tiene un impacto y vectores de ataque sin especificar. • http://osvdb.org/67570 http://secunia.com/advisories/41173 http://www-01.ibm.com/support/docview.wss?uid=swg1PM08360 http://www-01.ibm.com/support/docview.wss?uid=swg1PM16014 http://www-01.ibm.com/support/docview.wss?uid=swg21443736 http://www-01.ibm.com/support/docview.wss?uid=swg24027708 http://www-01.ibm.com/support/docview.wss? • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 54EXPL: 0CVE-2010-0779
https://notcve.org/view.php?id=CVE-2010-0779
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.33, and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la consola de administración en IBM WebSphere Application Server (WAS) v6.0 anterior v6.0.2.43, v6.1 anterior v6.1.0.33, y v7.0 anterior v 7.0.0.11 permite a atacantes remotos inyectar código web o HTML de su elección a través de vectores no especificados. • http://www-1.ibm.com/support/docview.wss?uid=swg1PM09250 https://exchange.xforce.ibmcloud.com/vulnerabilities/59647 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 26EXPL: 0CVE-2010-0778
https://notcve.org/view.php?id=CVE-2010-0778
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.33 and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la consola de administración en IBM WebSphere Application Server (WAS) v6.1 anterior v6.1.0.33 y v7.0 anterior v7.0.0.11 permite a atacantes remotos inyectar código web o HTML de su elección a través de vectores no especificados. • http://www-1.ibm.com/support/docview.wss?uid=swg1PM11778 https://exchange.xforce.ibmcloud.com/vulnerabilities/59646 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •