CVSS: 5.0EPSS: 2%CPEs: 20EXPL: 1CVE-2005-1112 – IBM Websphere 5.0/5.1/6.0 - Application Server Web Server Root JSP Source Code Disclosure
https://notcve.org/view.php?id=CVE-2005-1112
IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the JSP engine. • https://www.exploit-db.com/exploits/25420 http://marc.info/?l=bugtraq&m=111342594129109&w=2 http://secunia.com/advisories/14962 http://securitytracker.com/id?1013697 http://www.osvdb.org/15501 http://www.securityfocus.com/bid/13160 https://exchange.xforce.ibmcloud.com/vulnerabilities/20099 •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2005-0425
https://notcve.org/view.php?id=CVE-2005-0425
Unknown vulnerability in IBM Websphere Application Server 5.0, 5.1, and 6.0 when running on Windows, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via a crafted URL that causes the page to be processed by the file serving servlet instead of the JSP engine. Vulnerabilidad desconocida en IBM Websphere Application Server 5.0, 5.1, y 6.0 cuando es ejecutado en Windows, permite a atacantes remotos obtener el código fuente de Java Server Pages (.jsp) mediante una URL alterada que hace que la página sea procesada por el fichero que sirve el servlet en lugar de por el motor JSP. • http://secunia.com/advisories/14274 http://www-1.ibm.com/support/docview.wss?uid=swg24008814 http://www-1.ibm.com/support/docview.wss?uid=swg24008815 •
CVSS: 1.9EPSS: 0%CPEs: 1EXPL: 1CVE-2003-1447
https://notcve.org/view.php?id=CVE-2003-1447
IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML. • http://securityreason.com/securityalert/3277 http://www.securityfocus.com/archive/1/310118 http://www.securityfocus.com/archive/1/310796 http://www.securityfocus.com/bid/6758 https://exchange.xforce.ibmcloud.com/vulnerabilities/11245 • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 1CVE-2002-1153
https://notcve.org/view.php?id=CVE-2002-1153
IBM Websphere 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with long HTTP headers, such as "Host". IBM Websphere 4.0.3 permite a atacantes remotos causar una denegación de servicio (caída), y posiblemente ejecutar código arbitrario mediante una petición HTTP con cabeceras HTTP largas, como "Host". • ftp://ftp.software.ibm.com/software/websphere/appserv/support/fixes/pq62144/readme.txt http://marc.info/?l=bugtraq&m=103244572803950&w=2 http://www.iss.net/security_center/static/10140.php http://www.osvdb.org/2092 http://www.securityfocus.com/bid/5749 •
CVSS: 4.6EPSS: 0%CPEs: 10EXPL: 0CVE-2001-1189
https://notcve.org/view.php?id=CVE-2001-1189
IBM Websphere Application Server 3.5.3 and earlier stores a password in cleartext in the sas.server.props file, which allows local users to obtain the passwords via a JSP script. IBM Websphere Application Server 3.5.3 y versiones anteriores almacenan una contraseña en formato textual en el fichero sas.server.props, lo que permite a usuarios locales la obtención de dicha contraseña mediante una rutina JSP. • http://www.iss.net/security_center/static/7698.php http://www.securityfocus.com/archive/1/245324 http://www.securityfocus.com/bid/3682 •