CVSS: 6.1EPSS: 0%CPEs: 50EXPL: 0CVE-2013-0459
https://notcve.org/view.php?id=CVE-2013-0459
27 Jan 2013 — Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Cross-site scripting (XSS) en la consola administrativa de IBM WebSphere Application Server (WAS) v6,1 antes de v6.1.0.47, 7,0 antes de 7.0.0.27, 8,0 antes de 8.0.0.6 y 8.5 antes de 8.5.0.2 que permite a atacantes remotos inye... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM72536 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2013-0462
https://notcve.org/view.php?id=CVE-2013-0462
27 Jan 2013 — Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors. Vulnerabilidad no especificada en IBM WebSphere Application Server (WAS) v6,1, v7,0 antes de v7.0.0.27, v8.0, y v8.5 tiene un impacto desconocido y vectores de ataque. • http://www.ibm.com/connections/blogs/PSIRT/entry/security_vulnerabilities_fixed_in_ibm_websphere_application_server_7_0_0_2785 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2012-4851
https://notcve.org/view.php?id=CVE-2012-4851
14 Nov 2012 — Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en IBM WebSphere Application Server v8.5 Liberty Profile antes de v8.5.0.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un URI diseñada para tal fin. • http://www-01.ibm.com/support/docview.wss?uid=swg1PM68643 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2012-4850
https://notcve.org/view.php?id=CVE-2012-4850
14 Nov 2012 — IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1, when JAX-RS is used, does not properly validate requests, which allows remote attackers to gain privileges via unspecified vectors. IBM WebSphere Application Server v8.5 Liberty Profile antes de v8.5.0.1, cuando se usa JAX-RS, no valida correctamente las solicitudes, lo que permite a atacantes remotos obtener privilegios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PM67082 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 56EXPL: 0CVE-2012-4853
https://notcve.org/view.php?id=CVE-2012-4853
14 Nov 2012 — Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger information disclosure. Una vulnerabilidad de falsificación de peticiones en sitios cruzados (CSRF) en IBM WebSphere Application Server v6.1 antes de v6.1.0.45, v7.0 antes de v7.0.0.25, v8.0 antes de v8.0.0.5 y v8.5 antes de v8.5.0.1 permite a l... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM62920 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0CVE-2012-3330
https://notcve.org/view.php?id=CVE-2012-3330
14 Nov 2012 — The proxy server in IBM WebSphere Application Server 7.0 before 7.0.0.27, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, and WebSphere Virtual Enterprise, allows remote attackers to cause a denial of service (daemon outage) via a crafted request. El servidor proxy en IBM WebSphere Application Server v7.0 antes de v7.0.0.27, v8.0 antes de v8.0.0.5 y v8.5 antes de v8.5.0.1 y WebSphere Virtual Enterprise, permite a atacantes remotos provocar una denegación de servicio (parada del demonio) a través de una solicitu... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM71319 •
CVSS: 9.8EPSS: 0%CPEs: 51EXPL: 0CVE-2012-3304
https://notcve.org/view.php?id=CVE-2012-3304
25 Sep 2012 — The Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack sessions via unspecified vectors. La consola de administración de IBM WebSphere Application Server (WAS) v6.1 antes de v6.1.0.45, v7.0 antes de v7.0.0.25, v8.0 antes de v8.0.0.5, y v8.5 antes de v8.5.0.1 permite a los atacantes remotos secuestrar sesiones a través de vectores no especificados. • http://osvdb.org/85733 •
CVSS: 7.8EPSS: 0%CPEs: 52EXPL: 0CVE-2012-3311
https://notcve.org/view.php?id=CVE-2012-3311
25 Sep 2012 — IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 on z/OS, in certain configurations involving Federated Repositories for IIOP connections and Optimized Local Adapters, does not perform CBIND checks, which allows local users to bypass intended access restrictions, and read or modify application data, via unspecified vectors. IBM WebSphere Application Server (WAS) v6.1 anteriores a v6.1.0.45, 7.0 anteriores a v7.0.0.25, 8.0 anteriores ... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM61388 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 64EXPL: 0CVE-2012-3305
https://notcve.org/view.php?id=CVE-2012-3305
25 Sep 2012 — Directory traversal vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to overwrite arbitrary files via a crafted application file. Vulnerabilidad de salto de directorio en IBM WebSphere Application Server (WAS) v6.1 antes de v6.1.0.47, v7.0 antes de v7.0.0.25, v8.0 antes de v8.0.0.5, y v8.5 antes de v8.5.0.1 e permite a atacantes remotos sobreescribir archivos de su elección a través de un arch... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM62467 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 51EXPL: 0CVE-2012-3306
https://notcve.org/view.php?id=CVE-2012-3306
25 Sep 2012 — IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, when multi-domain support is configured, does not purge password data from the authentication cache, which has unspecified impact and remote attack vectors. IBM WebSphere Application Server (WAS) v6.1 antes de v6.1.0.45, v7.0 antes de v7.0.0.25, v8.0 antes de v8.0.0.5, y v8.5 antes de v8.5.0.1, cuando el soporte multi-dominio está configurado, no elimina la contraseña de la caché de a... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM66514 • CWE-255: Credentials Management Errors •