CVSS: 5.0EPSS: 0%CPEs: 20EXPL: 0CVE-2010-3700 – Spring Security Security Constraint Bypass
https://notcve.org/view.php?id=CVE-2010-3700
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter. VMware SpringSource Spring Security v2.x anterior a v2.0.6 y v3.x anterior a v3.0.4, y Acegi Security v1.0.0 hasta v1.0.7, como el usado en IBM WebSphere Application Server (WAS) v6.1 y v7.0, permite a los atacantes remotos evitar las restricciones de seguridad a través de un parámetro de ruta. Spring Security does not consider URL path parameters when processing security constraints. By adding an URL path parameter to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). • http://osvdb.org/68931 http://secunia.com/advisories/42024 http://www.securityfocus.com/archive/1/514517/100/0/threaded http://www.securityfocus.com/bid/44496 http://www.springsource.com/security/cve-2010-3700 https://issues.apache.org/bugzilla/show_bug.cgi?id=25015 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 1%CPEs: 33EXPL: 0CVE-2010-3186
https://notcve.org/view.php?id=CVE-2010-3186
IBM WebSphere Application Server (WAS) 7.x before 7.0.0.13, and WebSphere Application Server Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, when a JAX-WS application is used, does not properly handle an IncludeTimestamp setting in the WS-Security policy, which has unspecified impact and remote attack vectors. El servidor de aplicaciones IBM WebSphere (WAS) v7.x en versiones anteriores a la v7.0.0.13, y WebSphere Application Server Feature Pack para Web Services v6.1.0.9 hasta la v6.1.0.32, si se utiliza una aplicación JAX-WS, no maneja apropiadamente una opción de configuración IncludeTimestamp en la política WS-Security, lo que tiene un impacto y vectores de ataque sin especificar. • http://osvdb.org/67570 http://secunia.com/advisories/41173 http://www-01.ibm.com/support/docview.wss?uid=swg1PM08360 http://www-01.ibm.com/support/docview.wss?uid=swg1PM16014 http://www-01.ibm.com/support/docview.wss?uid=swg21443736 http://www-01.ibm.com/support/docview.wss?uid=swg24027708 http://www-01.ibm.com/support/docview.wss? • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 26EXPL: 0CVE-2010-0778
https://notcve.org/view.php?id=CVE-2010-0778
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.33 and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la consola de administración en IBM WebSphere Application Server (WAS) v6.1 anterior v6.1.0.33 y v7.0 anterior v7.0.0.11 permite a atacantes remotos inyectar código web o HTML de su elección a través de vectores no especificados. • http://www-1.ibm.com/support/docview.wss?uid=swg1PM11778 https://exchange.xforce.ibmcloud.com/vulnerabilities/59646 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 54EXPL: 0CVE-2010-0779
https://notcve.org/view.php?id=CVE-2010-0779
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.43, 6.1 before 6.1.0.33, and 7.0 before 7.0.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la consola de administración en IBM WebSphere Application Server (WAS) v6.0 anterior v6.0.2.43, v6.1 anterior v6.1.0.33, y v7.0 anterior v 7.0.0.11 permite a atacantes remotos inyectar código web o HTML de su elección a través de vectores no especificados. • http://www-1.ibm.com/support/docview.wss?uid=swg1PM09250 https://exchange.xforce.ibmcloud.com/vulnerabilities/59647 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2010-2323
https://notcve.org/view.php?id=CVE-2010-2323
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.11 on z/OS might allow attackers to obtain sensitive information by reading the default_create.log file that is associated with profile creation by the BBOWWPFx job and the zPMT. IBM WebSphere Application Server (WAS) v7.0 anteriores a v7.0.0.11 en z/OS podría permitir a atacantes, obtener información sensible leyendo el fichero default_create.log, que está asociado con la creación de perfiles por los trabajos BBOWWPFx y zPMT. • http://secunia.com/advisories/40096 http://www-01.ibm.com/support/docview.wss?uid=swg1PM10454 http://www-01.ibm.com/support/docview.wss?uid=swg1PM15830 http://www.vupen.com/english/advisories/2010/1411 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •