CVSS: 6.0EPSS: 0%CPEs: 56EXPL: 0CVE-2012-3325
https://notcve.org/view.php?id=CVE-2012-3325
IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.5, and 8.5.x Full Profile before 8.5.0.1, when the PM44303 fix is installed, does not properly validate credentials, which allows remote authenticated users to obtain administrative access via unspecified vectors. IBM WebSphere Application Server (WAS) v6.1.x anterior a v6.1.0.45, v7.0.x anterior a v7.0.0.25, v8.0.x anterior a v8.0.0.5, y v8.5.x Full Profile anterior a v8.5.0.1, cuando el parche PM44303 esta instalado, no valida adecuadamente las credenciales, lo cual puede permitir a usuarios remotos autenticados obtener acceso administrativo a través de vectores no especificados. • http://secunia.com/advisories/54971 http://secunia.com/advisories/55115 http://www-01.ibm.com/support/docview.wss?uid=swg1PM71296 http://www.ibm.com/support/docview.wss?uid=swg21609067 http://www.securityfocus.com/bid/55309 http://www.securitytracker.com/id?1027462 https://exchange.xforce.ibmcloud.com/vulnerabilities/77959 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 47EXPL: 0CVE-2012-3293
https://notcve.org/view.php?id=CVE-2012-3293
Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving FRAME elements, related to a cross-frame scripting (XFS) issue. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la consola de administración en IBM WebSphere Application Server (WAS) v6.1.x anterior a v6.1.0.45, v7.0.x anterior a v7.0.0.25, v8.0.x anterior a v8.0.0.4, y v8.5.x anterior a v8.5.0.1 que permite a atacantes remotos inyectar código web o html arbitrario a través de vectores que involucran elementos (FRAME), relacionados con un problema ejecución de código en marcos cruzados (cross-frame scripting) (XFS). • http://www-01.ibm.com/support/docview.wss?uid=swg1PM60839 http://www-01.ibm.com/support/docview.wss?uid=swg21606096 http://www-01.ibm.com/support/docview.wss?uid=swg27022958 http://www.securityfocus.com/bid/55149 https://exchange.xforce.ibmcloud.com/vulnerabilities/77179 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 47EXPL: 0CVE-2012-2190
https://notcve.org/view.php?id=CVE-2012-2190
IBM Global Security Kit (aka GSKit), as used in IBM HTTP Server in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.4, and 8.5.x before 8.5.0.1, allows remote attackers to cause a denial of service (daemon crash) via a crafted ClientHello message in the TLS Handshake Protocol. IBM Global Security Kit (aka GSKit), utilizdo en IBM HTTP Server en IBM WebSphere Application Server (WAS) v6.1.x anterior a v6.1.0.45, v7.0.x anterior a v7.0.0.25, v8.0.x anterior a v8.0.0.4, y v8.5.x anterior a v8.5.0.1, permite a atacantes remotos causar una denegación de servicio (caída de demonio) a través de un mensaje (ClientHello) manipulado in el protocolo (TLS Handshake). • http://www-01.ibm.com/support/docview.wss?uid=swg1PM66218 http://www-01.ibm.com/support/docview.wss?uid=swg21606096 https://exchange.xforce.ibmcloud.com/vulnerabilities/75994 • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 1%CPEs: 67EXPL: 0CVE-2012-0193
https://notcve.org/view.php?id=CVE-2012-0193
IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.43, 6.1 before 6.1.0.43, 7.0 before 7.0.0.23, and 8.0 before 8.0.0.3 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. IBM WebSphere Application Server (WAS) v6.0 hasta v6.0.2.43, v6.1 antes de v6.1.0.43 6.1, v7.0 antes de v7.0.0.23, v8.0 antes de v8.0.0.3 calcula los valores hash de los parámetros de los formularios sin restringir la posibilidad de ocasionar colisiones hash de una forma predecible, lo que permite provocar una denegación de servicio (por consumo de CPU) a atacantes remotos mediante el envío de gran cantidad de parámetros generados para este fin. • http://osvdb.org/78321 http://www-01.ibm.com/support/docview.wss?uid=swg1PM53930 http://www-01.ibm.com/support/docview.wss?uid=swg21577532 http://www-01.ibm.com/support/docview.wss?uid=swg24031821 • CWE-20: Improper Input Validation •
CVSS: 4.6EPSS: 0%CPEs: 35EXPL: 0CVE-2011-1376
https://notcve.org/view.php?id=CVE-2011-1376
iscdeploy in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under systemapps/isclite.ear/ and bin/client_ffdc/, which allows local users to read or modify files via standard filesystem operations. iscdeploy en IBM WebSphere Application Server (WAS) v6.1 antes de v6.1.0.43, v7.0 antes de v7.0.0.21 y v8.0 antes de v8.0.0.2 en la plataforma IBM i establece permisos débiles bajo systemApps/isclite.ear y /bin/client_ffdc/, lo que permite leer o modificar archivos a usuarios locales a través de operaciones estándar del sistema de archivos. • http://www-01.ibm.com/support/docview.wss?uid=swg21569205 http://www-01.ibm.com/support/docview.wss?uid=swg24031675 http://www.ibm.com/support/docview.wss?uid=swg1PM49712 https://exchange.xforce.ibmcloud.com/vulnerabilities/71230 • CWE-264: Permissions, Privileges, and Access Controls •