CVSS: 6.8EPSS: 0%CPEs: 59EXPL: 0CVE-2009-2746
https://notcve.org/view.php?id=CVE-2009-2746
Cross-site request forgery (CSRF) vulnerability in the administrative console in the Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 allows remote attackers to hijack the authentication of administrators via unspecified vectors. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en la consola de administración en el componente Security en IBM WebSphere Application Server (WAS) v6.0.2 anteriores a v6.0.2.39, v6.1 anteriores a v6.1.0.29, y v7.0 anteriores a v7.0.0.7 permite a atacantes remotos secuestrar la autenticación de administradores mediante vectores no especificados. • http://secunia.com/advisories/37221 http://www-01.ibm.com/support/docview.wss?uid=swg1PK87176 http://www-01.ibm.com/support/docview.wss?uid=swg1PK99477 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 https://exchange.xforce.ibmcloud.com/vulnerabilities/54227 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 29EXPL: 0CVE-2009-2744
https://notcve.org/view.php?id=CVE-2009-2744
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27 allows remote attackers to cause a denial of service via unknown vectors, related to "an error in fixpacks 6.1.0.23 and 6.1.0.25." Vulnerabilidad no especificada en IBM WebSphere Application Server (WAS) v6.1 anteriores a v6.1.0.27 permite a atacantes remotos provocar una denegación de servicio mediante vectores desconocidos, relacionado con "un error en fixpacks v6.1.0.23 y v6.1.0.25". • http://www-01.ibm.com/support/docview.wss?uid=swg27007951 http://www-1.ibm.com/support/docview.wss?uid=swg1PK91709 http://www.vupen.com/english/advisories/2009/2721 https://exchange.xforce.ibmcloud.com/vulnerabilities/53344 •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2009-2742
https://notcve.org/view.php?id=CVE-2009-2742
Cross-site scripting (XSS) vulnerability in Eclipse Help in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27 allows remote attackers to inject arbitrary web script or HTML via unspecified input. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la ayuda de Eclipse del servidor de aplicaciones IBM WebSphere (WAS) en versiones v6.1 anteriores a la v 6.1.0.27 permite a usuarios remotos inyectar codigo de script web o código HTML a través de una entrada sin especificar. • http://www-01.ibm.com/support/docview.wss?uid=swg27007951 http://www-1.ibm.com/support/docview.wss?uid=swg1PK78917 http://www.vupen.com/english/advisories/2009/2721 https://exchange.xforce.ibmcloud.com/vulnerabilities/53342 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.1EPSS: 0%CPEs: 22EXPL: 0CVE-2009-2743
https://notcve.org/view.php?id=CVE-2009-2743
IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after use of wsadmin scripts and configuration of JAAS-J2C Authentication Data, which allows local users to obtain sensitive information by reading the First Failure Data Capture (FFDC) log file. En WebSphere Application Server (WAS) de IBM versiones 6.1 anteriores a 6.1.0.27 y versiones 7.0 anteriores a 7.0.0.7, no manejan apropiadamente una excepción que se produce después del uso de scripts wsadmin y la configuración de JAAS-J2C Authentication Data, que permite a los usuarios locales obtener información confidencial mediante la lectura del archivo de registro de First Failure Data Capture (FFDC). • http://secunia.com/advisories/37796 http://www-01.ibm.com/support/docview.wss?uid=swg27007951 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www-1.ibm.com/support/docview.wss?uid=swg1PK86137 http://www.vupen.com/english/advisories/2009/2721 https://exchange.xforce.ibmcloud.com/vulnerabilities/53343 •
CVSS: 5.0EPSS: 0%CPEs: 35EXPL: 0CVE-2009-3106
https://notcve.org/view.php?id=CVE-2009-3106
The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.37 does not properly implement security constraints on the (1) doGet and (2) doTrace methods, which allows remote attackers to bypass intended access restrictions and obtain sensitive information via a crafted HTTP HEAD request to a Web Application. El componente Servlet Engine/Web Container en IBM WebSphere Application Server (WAS) v6.0.2 anterior a v6.0.2.37, no implementa adecuadamente las restricciones de seguridad sobre los métodos (1) doGet y (2) doTrace, lo que permite a atacantes remotos evitar las restricciones de acceso intencionadas y obtener información sensible a través de una petición de cabecera (HEAD) HTTP a la Aplicación Web. • http://www-01.ibm.com/support/docview.wss?uid=swg27006876 http://www-1.ibm.com/support/docview.wss?uid=swg1PK83258 https://exchange.xforce.ibmcloud.com/vulnerabilities/53051 • CWE-264: Permissions, Privileges, and Access Controls •