CVSS: 7.5EPSS: 0%CPEs: 64EXPL: 0CVE-2012-3305
https://notcve.org/view.php?id=CVE-2012-3305
25 Sep 2012 — Directory traversal vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to overwrite arbitrary files via a crafted application file. Vulnerabilidad de salto de directorio en IBM WebSphere Application Server (WAS) v6.1 antes de v6.1.0.47, v7.0 antes de v7.0.0.25, v8.0 antes de v8.0.0.5, y v8.5 antes de v8.5.0.1 e permite a atacantes remotos sobreescribir archivos de su elección a través de un arch... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM62467 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 51EXPL: 0CVE-2012-3306
https://notcve.org/view.php?id=CVE-2012-3306
25 Sep 2012 — IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, when multi-domain support is configured, does not purge password data from the authentication cache, which has unspecified impact and remote attack vectors. IBM WebSphere Application Server (WAS) v6.1 antes de v6.1.0.45, v7.0 antes de v7.0.0.25, v8.0 antes de v8.0.0.5, y v8.5 antes de v8.5.0.1, cuando el soporte multi-dominio está configurado, no elimina la contraseña de la caché de a... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM66514 • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 56EXPL: 0CVE-2012-3325
https://notcve.org/view.php?id=CVE-2012-3325
30 Aug 2012 — IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.5, and 8.5.x Full Profile before 8.5.0.1, when the PM44303 fix is installed, does not properly validate credentials, which allows remote authenticated users to obtain administrative access via unspecified vectors. IBM WebSphere Application Server (WAS) v6.1.x anterior a v6.1.0.45, v7.0.x anterior a v7.0.0.25, v8.0.x anterior a v8.0.0.5, y v8.5.x Full Profile anterior a v8.5.0.1, cuando el parche PM44303 e... • http://secunia.com/advisories/54971 • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 47EXPL: 0CVE-2012-2190
https://notcve.org/view.php?id=CVE-2012-2190
21 Aug 2012 — IBM Global Security Kit (aka GSKit), as used in IBM HTTP Server in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1, allows remote attackers to cause a denial of service (daemon crash) via a crafted ClientHello message in the TLS Handshake Protocol. IBM Global Security Kit (aka GSKit), utilizdo en IBM HTTP Server en IBM WebSphere Application Server (WAS) v6.1.x anterior a v6.1.0.45, v7.0.x anterior a v7.0.0.25, v8.0.x anterio... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM66218 • CWE-310: Cryptographic Issues •
CVSS: 6.1EPSS: 0%CPEs: 47EXPL: 0CVE-2012-3293
https://notcve.org/view.php?id=CVE-2012-3293
21 Aug 2012 — Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements, related to a cross-frame scripting (XFS) issue. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la consola de administración en IBM WebSphere Application Server (WAS) v6.1.x anterior a ... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM60839 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0CVE-2012-0720
https://notcve.org/view.php?id=CVE-2012-0720
20 Jun 2012 — Cross-site scripting (XSS) vulnerability in the Integration Solution Console in the Administration Console in IBM WebSphere Application Server 7.0 before 7.0.0.23 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la consola de solución de integración IBM WebSphere Application Server v7.0 anterior a v7.0.0.23 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un UR... • http://www.ibm.com/support/docview.wss?uid=swg1PM52274 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0CVE-2012-0716
https://notcve.org/view.php?id=CVE-2012-0716
20 Jun 2012 — Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server 7.0 before 7.0.0.23 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la consola de administración de IBM WebSphere Application Server v7.0 anterior a v7.0.0.23 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://www.ibm.com/support/docview.wss?uid=swg1PM53132 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.4EPSS: 0%CPEs: 16EXPL: 0CVE-2012-0717
https://notcve.org/view.php?id=CVE-2012-0717
20 Jun 2012 — IBM WebSphere Application Server 7.0 before 7.0.0.23, when a certain SSLv2 configuration with client authentication is used, allows remote attackers to bypass X.509 client-certificate authentication via unspecified vectors. IBM WebSphere Application Server v7.0 anterior a v7.0.0.23, cuando se utiliza una cierta configuración de SSLv2 con la autenticación del cliente, permite a atacantes remotos eludir X.509 cliente certificado de autenticación a través de vectores no especificados. • http://www.ibm.com/support/docview.wss?uid=swg1PM52351 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0CVE-2012-2170
https://notcve.org/view.php?id=CVE-2012-2170
20 Jun 2012 — The Application Snoop Servlet in IBM WebSphere Application Server 7.0 before 7.0.0.23 does not properly restrict access, which allows remote attackers to obtain sensitive client and request information via a direct request. La aplicación de Snoop Servlet en IBM WebSphere Application Server v7.0 anterior a v7.0.0.23 no restringe el acceso, permite a atacantes remotos obtener información sensible de los clientes y la solicitud a través de una solicitud directa. • http://www.ibm.com/support/docview.wss?uid=swg1PM56183 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 0%CPEs: 135EXPL: 0CVE-2012-2162
https://notcve.org/view.php?id=CVE-2012-2162
01 May 2012 — The Web Server Plug-in in IBM WebSphere Application Server (WAS) 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password, which allows remote attackers to obtain sensitive information by sniffing the network, or spoof arbitrary servers via a man-in-the-middle attack. El complemento Web Server en IBM WebSphere Application Server (WAS) v8.0 y anteriores, utilizan comunicaciones sin HTTP cifrar después de la expiración de la contraseña de plugin-key.kdb, lo que permi... • http://www-01.ibm.com/support/docview.wss?uid=swg21588312 • CWE-310: Cryptographic Issues •