Page 9 of 115 results (0.020 seconds)

CVSS: 5.0EPSS: 1%CPEs: 67EXPL: 0

CVE-2012-0193

https://notcve.org/view.php?id=CVE-2012-0193

IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.43, 6.1 before 6.1.0.43, 7.0 before 7.0.0.23, and 8.0 before 8.0.0.3 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. IBM WebSphere Application Server (WAS) v6.0 hasta v6.0.2.43, v6.1 antes de v6.1.0.43 6.1, v7.0 antes de v7.0.0.23, v8.0 antes de v8.0.0.3 calcula los valores hash de los parámetros de los formularios sin restringir la posibilidad de ocasionar colisiones hash de una forma predecible, lo que permite provocar una denegación de servicio (por consumo de CPU) a atacantes remotos mediante el envío de gran cantidad de parámetros generados para este fin. • http://osvdb.org/78321 http://www-01.ibm.com/support/docview.wss?uid=swg1PM53930 http://www-01.ibm.com/support/docview.wss?uid=swg21577532 http://www-01.ibm.com/support/docview.wss?uid=swg24031821 • CWE-20: Improper Input Validation •

CVSS: 4.6EPSS: 0%CPEs: 35EXPL: 0

CVE-2011-1376

https://notcve.org/view.php?id=CVE-2011-1376

iscdeploy in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under systemapps/isclite.ear/ and bin/client_ffdc/, which allows local users to read or modify files via standard filesystem operations. iscdeploy en IBM WebSphere Application Server (WAS) v6.1 antes de v6.1.0.43, v7.0 antes de v7.0.0.21 y v8.0 antes de v8.0.0.2 en la plataforma IBM i establece permisos débiles bajo systemApps/isclite.ear y /bin/client_ffdc/, lo que permite leer o modificar archivos a usuarios locales a través de operaciones estándar del sistema de archivos. • http://www-01.ibm.com/support/docview.wss?uid=swg21569205 http://www-01.ibm.com/support/docview.wss?uid=swg24031675 http://www.ibm.com/support/docview.wss?uid=swg1PM49712 https://exchange.xforce.ibmcloud.com/vulnerabilities/71230 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.3EPSS: 0%CPEs: 45EXPL: 0

CVE-2011-1362

https://notcve.org/view.php?id=CVE-2011-1362

Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 and 7.0 before 7.0.0.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1308. Vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en la aplicación Installation Verification Test (IVT) en IBM WebSphere Application Server (WAS) v6.1 anterior a v6.1.0.41 y v7.0 anterior a v7.0.0.19 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2011-1308. • http://www-01.ibm.com/support/docview.wss?uid=swg1PM40733 http://www-01.ibm.com/support/docview.wss?uid=swg1PM65992 http://www-01.ibm.com/support/docview.wss?uid=swg27007951 https://exchange.xforce.ibmcloud.com/vulnerabilities/69731 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 31EXPL: 0

CVE-2011-5065

https://notcve.org/view.php?id=CVE-2011-5065

Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en IBM WebSphere Application Server (WAS) v anterior a v6.1.0.41 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores relacionados con mensajes web. • http://secunia.com/advisories/46469 http://www-01.ibm.com/support/docview.wss?uid=swg1PM37840 http://www-01.ibm.com/support/docview.wss?uid=swg1PM49872 http://www-01.ibm.com/support/docview.wss?uid=swg27007951 http://www.securityfocus.com/bid/51559 https://exchange.xforce.ibmcloud.com/vulnerabilities/72336 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 10.0EPSS: 0%CPEs: 31EXPL: 0

CVE-2011-1377

https://notcve.org/view.php?id=CVE-2011-1377

The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors. El componente Web Services Security en el producto Web Services Feature Pack anterior a versión 6.1.0.41 para WebSphere Application Server (WAS) versión 6.1 de IBM, no maneja apropiadamente la habilitación de WS-Security para una aplicación JAX-WS, que presenta un impacto y vectores de ataque no especificados. • http://secunia.com/advisories/46469 http://www-01.ibm.com/support/docview.wss?uid=swg1PM43792 http://www-01.ibm.com/support/docview.wss?uid=swg1PM50205 http://www-01.ibm.com/support/docview.wss?uid=swg27011716 http://www.securityfocus.com/bid/50310 https://exchange.xforce.ibmcloud.com/vulnerabilities/72299 •