CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2005-4413
https://notcve.org/view.php?id=CVE-2005-4413
Multiple cross-site scripting (XSS) vulnerabilities in sample scripts in IBM WebSphere Application Server 6 allow remote attackers to inject arbitrary web script or HTML via the (1) E-mail address field to (a) PlantsByWebSphere/login.jsp, (2) message field to (b) TechnologySample/BulletinBoard Script, (3) Email address field to (c) TechnologySamples/Subscription, and the (4) Movie Name, (5) Movie Reviewer, and (6) Movie Review fields to (d) TechnologySamples/MovieReview2_1. • http://securitytracker.com/id?1015360 http://www.ipomonis.com/advisories/ibm_css.txt http://www.securityfocus.com/bid/15929 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2005-3760
https://notcve.org/view.php?id=CVE-2005-3760
Double free vulnerability in the BBOORB module in IBM WebSphere Application Server for z/OS 5.0 allows attackers to cause a denial of service (ABEND). • http://secunia.com/advisories/17658 http://securitytracker.com/id?1015255 http://www-1.ibm.com/support/docview.wss?uid=swg1PK13936 http://www.vupen.com/english/advisories/2005/2522 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2005-3498
https://notcve.org/view.php?id=CVE-2005-3498
IBM WebSphere Application Server 5.0.x before 5.02.15, 5.1.x before 5.1.1.8, and 6.x before fixpack V6.0.2.5, when session trace is enabled, records a full URL including the queryString in the trace logs when an application encodes a URL, which could allow attackers to obtain sensitive information. • http://securitytracker.com/id?1015134 http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg27004980 http://www-1.ibm.com/support/docview.wss?uid=swg24010781 http://www.securityfocus.com/bid/15303 http://www.vupen.com/english/advisories/2005/2291 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 15%CPEs: 2EXPL: 1CVE-2005-2091
https://notcve.org/view.php?id=CVE-2005-2091
IBM WebSphere 5.1 and WebSphere 5.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebSphere to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." • http://seclists.org/lists/bugtraq/2005/Jun/0025.html http://securitytracker.com/id?1014367 http://www.securiteam.com/securityreviews/5GP0220G0U.html http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/42898 •
CVSS: 7.5EPSS: 51%CPEs: 1EXPL: 0CVE-2005-1872
https://notcve.org/view.php?id=CVE-2005-1872
Buffer overflow in the administrative console in IBM WebSphere Application Server 5.x, when the global security option is enabled, allows remote attackers to execute arbitrary code. • http://marc.info/?l=bugtraq&m=111817727120752&w=2 http://secunia.com/advisories/15598 http://www-1.ibm.com/support/docview.wss?rs=180&uid=swg24009775 http://www.appsecinc.com/resources/alerts/general/WEBSPHERE-001.html http://www.osvdb.org/17041 •