CVSS: 5.9EPSS: 0%CPEs: 49EXPL: 0CVE-2016-0306
https://notcve.org/view.php?id=CVE-2016-0306
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors. IBM WebSphere Application Server (WAS) 7.0 en versiones anteriores a 7.0.0.41, 8.0 en versiones anteriores a 8.0.0.13 y 8.5 en versiones anteriores a 8.5.5.10, cuando FIPS 140-2 está activado, configura incorrectamente TLS, lo que permite a atacantes man-in-the-middle obtener información sensible a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI56190 http://www-01.ibm.com/support/docview.wss?uid=swg21979231 http://www.securityfocus.com/bid/85978 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 47EXPL: 0CVE-2015-7417
https://notcve.org/view.php?id=CVE-2015-7417
Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider. Vulnerabilidad de XSS en IBM WebSphere Application Server 7.0 en versiones anteriores a 7.0.0.41, 8.0 en versiones anteriores a 8.0.0.12 y 8.5 en versiones anteriores a 8.5.5.9 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de datos de un proveedor OAuth manipulados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI49272 http://www-01.ibm.com/support/docview.wss?uid=swg21974520 http://www.securityfocus.com/bid/81738 http://www.securitytracker.com/id/1034783 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 97%CPEs: 21EXPL: 1CVE-2015-7450 – IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
https://notcve.org/view.php?id=CVE-2015-7450
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library. Interfaces de objetos serializados en determinados productos IBM analytics, business solutions, cognitive, IT infrastructure y mobile and social permiten a atacantes remotos ejecutar comandos arbitrarios a través de un objeto Java serializado manipulado, relacionado con la clase InvokerTransformer en la librería Apache Commons Collections. Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands • https://www.exploit-db.com/exploits/41613 http://www-01.ibm.com/support/docview.wss?uid=swg21970575 http://www-01.ibm.com/support/docview.wss?uid=swg21971342 http://www-01.ibm.com/support/docview.wss?uid=swg21971376 http://www-01.ibm.com/support/docview.wss?uid=swg21971733 http://www-01.ibm.com/support/docview.wss? •
CVSS: 4.3EPSS: 0%CPEs: 84EXPL: 0CVE-2015-2017
https://notcve.org/view.php?id=CVE-2015-2017
CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL. Vulnerabilidad de inyección CRLF en IBM WebSphere Application Server (WAS) 6.1 hasta la versión 6.1.0.47, 7.0 en versiones anteriores a 7.0.0.39, 8.0 en versiones anteriores a 8.0.0.12 y 8.5 en versiones anteriores a 8.5.5.8 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y realizar ataques de separación de respuesta HTTP a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI45266 http://www-01.ibm.com/support/docview.wss?uid=swg21966837 http://www.securityfocus.com/bid/78457 http://www.securitytracker.com/id/1034096 •
CVSS: 5.0EPSS: 0%CPEs: 55EXPL: 0CVE-2015-1932
https://notcve.org/view.php?id=CVE-2015-1932
IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header. Vulnerabilidad en IBM WebSpher Application Server en 7.x en versiones anteriores a 7.0.0.39, 8.0.x en versiones anteriores a 8.0.0.11, 8.5.x en versiones anteriores a 8.5.5.7 y WebSphere Virtual Enterprise en versiones anteriores a 7.0.0.7, permite a atacantes remotos obtener información potencialmente sensible sobre el software del servidor proxy leyendo el HTTP a través de las cabeceras. • http://www-01.ibm.com/support/docview.wss?uid=swg1PI38403 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 http://www.securityfocus.com/bid/76466 http://www.securitytracker.com/id/1033325 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •