CVSS: 4.3EPSS: 0%CPEs: 139EXPL: 0CVE-2011-1308
https://notcve.org/view.php?id=CVE-2011-1308
Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el Installation Verification Test (IVT) en el componente Install en IBM WebSphere Application Server (WAS) anteriores a v7.0.0.15, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PM20393 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www.securityfocus.com/bid/46736 http://www.vupen.com/english/advisories/2011/0564 https://exchange.xforce.ibmcloud.com/vulnerabilities/65992 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.1EPSS: 0%CPEs: 139EXPL: 0CVE-2011-1307
https://notcve.org/view.php?id=CVE-2011-1307
The installer in IBM WebSphere Application Server (WAS) before 7.0.0.15 uses 777 permissions for a temporary log directory, which allows local users to have unintended access to log files via standard filesystem operations, a different vulnerability than CVE-2009-1173. El programa de instalación de IBM WebSphere Application Server (WAS) anterior a v7.0.0.15 utiliza permisos 777 para un directorio de registro temporal, lo que permite a los usuarios locales a tener acceso a los archivos de registro a través de operaciones de sistema de archivos estándar, una vulnerabilidad diferente de CVE-2009-1173. • http://www-01.ibm.com/support/docview.wss?uid=swg1PM20021 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www.securityfocus.com/bid/46736 http://www.vupen.com/english/advisories/2011/0564 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 139EXPL: 0CVE-2011-1316
https://notcve.org/view.php?id=CVE-2011-1316
The Session Initiation Protocol (SIP) Proxy in the HTTP Transport component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (worker thread exhaustion and UDP messaging outage) by sending many UDP messages. El proxy Session Initiation Protocol (SIP) en el componente de transporte HTTP de IBM WebSphere Application Server (WAS) antes de v7.0.0.15 permite a atacantes remotos provocar una denegación de servicio (agotamiento de los hilo de trabajo y corte de mensajería UDP), enviando muchos mensajes UDP. • http://www-01.ibm.com/support/docview.wss?uid=swg1PM23115 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 139EXPL: 0CVE-2011-1318
https://notcve.org/view.php?id=CVE-2011-1318
Memory leak in org.apache.jasper.runtime.JspWriterImpl.response in the JavaServer Pages (JSP) component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) by accessing a JSP page of an application that is repeatedly stopped and restarted. Pérdida de memoria en org.apache.jasper.runtime.JspWriterImpl.response en el componente JavaServer Pages (JSP) de IBM WebSphere Application Server (WAS) antes de v7.0.0.15 permite a atacantes remotos provocar una denegación de servicio (consumo de memoria) mediante el acceso a una aplicación JSP que es detenida y reiniciada varias veces. • http://www-01.ibm.com/support/docview.wss?uid=swg1PM23029 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 139EXPL: 0CVE-2011-1309
https://notcve.org/view.php?id=CVE-2011-1309
The Plug-in component in IBM WebSphere Application Server (WAS) before 7.0.0.15 does not properly handle trace requests, which has unspecified impact and attack vectors. El componente Plug-in en IBM WebSphere Application Server (WAS) anterior a v7.0.0.15 no maneja adecuadamente las solicitudes de rastreo, lo que tiene un impacto y vectores de ataque no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1PM22860 http://www-01.ibm.com/support/docview.wss?uid=swg27014463 http://www.securityfocus.com/bid/46736 http://www.vupen.com/english/advisories/2011/0564 • CWE-20: Improper Input Validation •