CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2009-0504
https://notcve.org/view.php?id=CVE-2009-0504
WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message. WSPolicy en el componente Web Services en IBM WebSphere Application Server (WAS) v7.0.x anterior a v7.0.0.1 no reconoce adecuadamente la propiedad de vínculo IDAssertion.isUsed, lo que permite a usuarios locales descubrir una contraseña leyendo un mensaje SOAP. • http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www-1.ibm.com/support/docview.wss?uid=swg1PK73573 https://exchange.xforce.ibmcloud.com/vulnerabilities/48700 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 59EXPL: 0CVE-2009-0436
https://notcve.org/view.php?id=CVE-2009-0436
The (1) mod_ibm_ssl and (2) mod_cgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server (WAS), set incorrect permissions for AF_UNIX sockets, which has unknown impact and local attack vectors. Los módulos (1) mod_ibm_ssl y (2) mod_cgid en IBM HTTP Server v6.0.x anteriores a v6.0.2.31 y v6.1.x anteriores a v6.1.0.19, tal y como se utiliza en WebSphere Application Server (WAS), ajusta incorrectamente los permisos para los sockets AF_UNIX, lo que tiene un impacto desconocido y vectores de ataque locales. • http://www-01.ibm.com/support/docview.wss?uid=swg27006876 http://www-01.ibm.com/support/docview.wss?uid=swg27007033 http://www-01.ibm.com/support/docview.wss?uid=swg27007951 http://www-01.ibm.com/support/docview.wss?uid=swg27008517 http://www-1.ibm.com/support/docview.wss? • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.8EPSS: 0%CPEs: 109EXPL: 0CVE-2008-4284
https://notcve.org/view.php?id=CVE-2008-4284
Open redirect vulnerability in the ibm_security_logout servlet in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.x versions, 6.0.x before 6.0.2.33, and 6.1.x before 6.1.0.23 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage feature. Vulnerabilidad de redirección abierta en ibm_security_logout servlet en IBM WebSphere Application Server (WAS) v5.1.1.19 y anteriores a las versiones v5.x, v6.0.x anterior a v6.0.2.33, y v6.1.x anterior a v6.1.0.23. permite atacantes remotos redirigir a los usuarios a paginas web de su elección y producir atacantes de phising a través de la característica logoutExitPage. • http://www-1.ibm.com/support/docview.wss?uid=swg21320242 http://www-1.ibm.com/support/docview.wss?uid=swg24021527 http://www.securityfocus.com/bid/33700 https://exchange.xforce.ibmcloud.com/vulnerabilities/47200 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 1.9EPSS: 0%CPEs: 56EXPL: 0CVE-2009-0434
https://notcve.org/view.php?id=CVE-2009-0434
PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.31, 6.1.x before 6.1.0.21, and 7.0.x before 7.0.0.1, when Performance Monitoring Infrastructure (PMI) is enabled, allows local users to obtain sensitive information by reading the (1) systemout.log and (2) ffdc files. NOTE: this is probably a duplicate of CVE-2008-5413. PerfServlet en el componente PMI/Performance Tools de IBM WebSphere Application Server (WAS) v6.0.x anterior a v6.0.2.31, v6.1.x anterior a v6.1.0.21 y v7.0.x anterior a v7.0.0.1, cuando está habilitado Performance Monitoring Infrastructure (PMI), permite a usuarios locales obtener información sensible leyendo los ficheros (1) systemout.log y (2) ffdc. NOTA: Puede que esta vulnerabilidad sea la misma que CVE-2008-5413. • http://www-01.ibm.com/support/docview.wss?uid=swg27006876 http://www-01.ibm.com/support/docview.wss?uid=swg27007951 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www-1.ibm.com/support/docview.wss?uid=swg1PK63886 http://www-1.ibm.com/support/docview.wss? • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 26EXPL: 0CVE-2009-0435
https://notcve.org/view.php?id=CVE-2009-0435
Unspecified vulnerability in the IBM Asynchronous I/O (aka AIO or libibmaio) library in the Java Message Service (JMS) component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.17 on AIX 5.3 allows attackers to cause a denial of service (daemon crash) via vectors related to the aio_getioev2 and getEvent methods. Vulnerabilidad inespecifica en la libreria IBM Asynchronous I/O (tambien conocido como AIO o libibmaio) en el componente Java Message Service (JMS) en IBM WebSphere Application Server (WAS) v6.1.x anteriores a v6.1.0.7 en AIX v5.3 permite a los atacantes producir una denegacion de servicio (caida de demonio) a traves de vectores relacionados con los metodos "aio_getioev2" y "getEvent". • http://www-01.ibm.com/support/docview.wss?rs=0&uid=swg24019205 http://www-01.ibm.com/support/docview.wss?uid=swg27007951 http://www.securityfocus.com/bid/33700 https://exchange.xforce.ibmcloud.com/vulnerabilities/48525 •