CVSS: 7.5EPSS: 0%CPEs: 46EXPL: 0CVE-2011-1359
https://notcve.org/view.php?id=CVE-2011-1359
06 Sep 2011 — Directory traversal vulnerability in the administration console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41, 7.0 before 7.0.0.19, and 8.0 before 8.0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI. Vulnerabilidad de salto de directorio en la consola de administración en IBM WebSphere Application Server (WAS) v6.1 anteriores a v6.1.0.41, v7.0 anteriores a v7.0.0.19, y v8.0 anteriores a v8.0.0.1, permite a atacantes remotos leer ficheros locales de su elecci... • http://secunia.com/advisories/45749 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 44EXPL: 0CVE-2011-1355
https://notcve.org/view.php?id=CVE-2011-1355
19 Jul 2011 — Open redirect vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.19 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage parameter. Vulnerabilidad "Open redirect" en IBM WebSphere Application Server (WAS) v6.1 anterior a v6.1.0.39 y v7.0 anterior a 7.0.0.19 permite a atacantes remotos redirigir a los usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing a través del parámetro logoutE... • http://www.ibm.com/support/docview.wss?uid=swg1PM35701 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 44EXPL: 0CVE-2011-1356
https://notcve.org/view.php?id=CVE-2011-1356
19 Jul 2011 — IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.19 allows local users to obtain sensitive stack-trace information via a crafted Administration Console request. IBM WebSphere Application Server (WAS) v6.1 y anteriores a v6.1.0.39 y v7 y anteriores a v7.0.0.19 permite a usuarios locales obtener pilas de información de seguimiento a través de una solicitud diseñada para ello de la consola de administración. • http://www.ibm.com/support/docview.wss?uid=swg1PM36620 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 139EXPL: 3CVE-2010-3271 – IBM Websphere Application Server 7.0.0.13 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2010-3271
18 Jul 2011 — Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en la Integrat... • https://www.exploit-db.com/exploits/17404 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.9EPSS: 0%CPEs: 46EXPL: 0CVE-2011-1209
https://notcve.org/view.php?id=CVE-2011-1209
04 May 2011 — IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.17 uses a weak WS-Security XML encryption algorithm, which makes it easier for remote attackers to obtain plaintext data from a (1) JAX-RPC or (2) JAX-WS Web Services request via unspecified vectors related to a "decryption attack." El servidor de aplicaciones IBM WebSphere (WAS) 6.1 anteriores a 6.1.0.39 y 7.0 anteriores a 7.0.0.17 utiliza un algoritmo de encriptación XML WS-Security débil, lo que facilita a atacantes remotos o... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM34841 • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 1%CPEs: 100EXPL: 0CVE-2011-1683
https://notcve.org/view.php?id=CVE-2011-1683
13 Apr 2011 — IBM WebSphere Application Server (WAS) 6.0.x through 6.0.2.43, 6.1.x before 6.1.0.37, and 7.0.x before 7.0.0.17 on z/OS, when a Local OS user registry or Federated Repository with RACF adapter is used, allows remote attackers to obtain unspecified application access via unknown vectors. IBM WebSphere Application Server (WAS) v6.0.x hasta v6.0.2.43, v6.1.x anterior a v6.1.0.37, y v7.0.x anterior a v7.0.0.17 sobre z/OS, cuando un usuario registrado en Locla OS o Federated Repository con adaptador RACF está us... • http://secunia.com/advisories/43965 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.1EPSS: 0%CPEs: 139EXPL: 0CVE-2011-1307
https://notcve.org/view.php?id=CVE-2011-1307
08 Mar 2011 — The installer in IBM WebSphere Application Server (WAS) before 7.0.0.15 uses 777 permissions for a temporary log directory, which allows local users to have unintended access to log files via standard filesystem operations, a different vulnerability than CVE-2009-1173. El programa de instalación de IBM WebSphere Application Server (WAS) anterior a v7.0.0.15 utiliza permisos 777 para un directorio de registro temporal, lo que permite a los usuarios locales a tener acceso a los archivos de registro a través d... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM20021 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 33EXPL: 0CVE-2011-1322
https://notcve.org/view.php?id=CVE-2011-1322
08 Mar 2011 — The SOAP with Attachments API for Java (SAAJ) implementation in the Web Services component in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.37 and 7.x before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) via encrypted SOAP messages. La implementación de SOAP con adjuntos para la API Java (SAAJ) en el componente de servicios Web en IBM WebSphere Application Server (WAS) v6.1.0.x antes de v6.1.0.37 y v7.x antes de v7.0.0.15, permite a atacantes remotos provoc... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM19534 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 32EXPL: 0CVE-2011-1313
https://notcve.org/view.php?id=CVE-2011-1313
08 Mar 2011 — Double free vulnerability in IBM WebSphere Application Server (WAS) 6.1.0.x before 6.1.0.35 and 7.x before 7.0.0.15 allows remote backend IIOP servers to cause a denial of service (S0C4 ABEND and storage corruption) by rejecting IIOP requests at opportunistic time instants, as demonstrated by requests associated with an ORB_Request::getACRWorkElementPtr function call. Doble vulnerabilidad libre en IBM WebSphere Application Server (WAS) v6.1.0.x antes de v6.1.0.35 y v7.x antes de v7.0.0.15, permite Servidore... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM17170 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 139EXPL: 0CVE-2011-1316
https://notcve.org/view.php?id=CVE-2011-1316
08 Mar 2011 — The Session Initiation Protocol (SIP) Proxy in the HTTP Transport component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (worker thread exhaustion and UDP messaging outage) by sending many UDP messages. El proxy Session Initiation Protocol (SIP) en el componente de transporte HTTP de IBM WebSphere Application Server (WAS) antes de v7.0.0.15 permite a atacantes remotos provocar una denegación de servicio (agotamiento de los hilo de trabajo y c... • http://www-01.ibm.com/support/docview.wss?uid=swg1PM23115 • CWE-399: Resource Management Errors •