Ibm Websphere Application Server vulnerabilities

CVE-2009-1900 [MEDIUM] CWE-200 CVE-2009-1900: The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server ( The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5, when tracing is enabled, allow remote attackers to obtain sensitive information via unspecified use of the wsadmin scripting tool.

CVE-2009-1898 [MEDIUM] CWE-200 CVE-2009-1898: The secure login page in the Administrative Console component in IBM WebSphere Application Server (W The secure login page in the Administrative Console component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 does not redirect to an https page upon receiving an http request, which makes it easier for remote attackers to read the contents of WAS sessions by sniffing the network.

CVE-2009-0899 [MEDIUM] CWE-264 CVE-2009-0899: IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4, IBM WebSphere P IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4, IBM WebSphere Portal Server 5.1 through 6.0, and IBM Integrated Solutions Console (ISC) 6.0.1 do not properly set the IsSecurityEnabled security flag during migration of WebSphere Member Manager (WMM) to Virtual Member Manager (VMM) and a Federated Repository, which a

CVE-2009-1172 [CRITICAL] CWE-20 CVE-2009-1172: The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has unknown impact and attack vectors.

CVE-2009-1174 [CRITICAL] CWE-310 CVE-2009-1174: The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 and 7.0 before 7.0.0.3 has an unspecified "security problem" in the XML digital-signature specification, which has unknown impact and attack vectors.

CVE-2009-0892 [MEDIUM] CWE-287 CVE-2009-0892: The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 bef The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout.

CVE-2009-1173 [LOW] CWE-264 CVE-2009-1173: IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3 uses weak permissions (777) for files asso IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3 uses weak permissions (777) for files associated with unspecified "interim fixes," which allows attackers to modify files that would not have been accessible if the intended 755 permissions were used.

CVE-2009-0891 [MEDIUM] CWE-287 CVE-2009-0891: The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0 The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),and 6.0.2 before Fix Pack 33 (6.0.2.33) does not properly enforce (1) nonce and (2) timestamp expiration values in WS-Security bindings as stored in the com.ibm.wsspi.wssecurity.core custom property, which allows r

CVE-2009-0508 [HIGH] CWE-200 CVE-2009-0508: The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, The Servlet Engine/Web Container and JSP components in IBM WebSphere Application Server (WAS) 5.1.0, 5.1.1.19, 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.23, and 7.0 before 7.0.0.3 allow remote attackers to read arbitrary files contained in war files in (1) web-inf, (2) meta-inf, and unspecified other directories via unknown vectors, related to (a) web-bas

CVE-2009-0855 [MEDIUM] CWE-79 CVE-2009-0855: Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2009-0856 [MEDIUM] CWE-79 CVE-2009-0856: Multiple cross-site scripting (XSS) vulnerabilities in sample applications in IBM WebSphere Applicat Multiple cross-site scripting (XSS) vulnerabilities in sample applications in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, and 6.1 before 6.1.0.23 on z/OS, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2009-0506 [MEDIUM] CVE-2009-0506: Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1 and 6.0.2 before 6.0.2.33 on Unspecified vulnerability in IBM WebSphere Application Server (WAS) 5.1 and 6.0.2 before 6.0.2.33 on z/OS, when CSIv2 Identity Assertion is enabled and Enterprise JavaBeans (EJB) interaction occurs between a WAS 6.1 instance and a WAS pre-6.1 instance, allows local users to have an unknown impact via vectors related to (1) use of the wrong subject and (2) mul

CVE-2008-4285 [MEDIUM] CWE-399 CVE-2008-4285: Unspecified vulnerability in the Performance Monitoring Infrastructure (PMI) feature in the Servlet Unspecified vulnerability in the Performance Monitoring Infrastructure (PMI) feature in the Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19, when a component statistic is enabled, allows attackers to cause a denial of service (daemon crash) via vectors related to "a gradual degradation in performan

CVE-2009-0504 [LOW] CWE-200 CVE-2009-0504: WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0. WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message.

CVE-2008-4283 [CRITICAL] CWE-20 CVE-2008-4283: CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server (WAS) CRLF injection vulnerability in the WebContainer component in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.1.x versions allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

CVE-2009-0436 [HIGH] CWE-264 CVE-2009-0436: The (1) mod_ibm_ssl and (2) mod_cgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x befo The (1) mod_ibm_ssl and (2) mod_cgid modules in IBM HTTP Server 6.0.x before 6.0.2.31 and 6.1.x before 6.1.0.19, as used in WebSphere Application Server (WAS), set incorrect permissions for AF_UNIX sockets, which has unknown impact and local attack vectors.

CVE-2009-0438 [MEDIUM] CVE-2009-0438: IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 on Windows allows remote attackers to bypass IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 on Windows allows remote attackers to bypass "Authorization checking" and obtain sensitive information from JSP pages via a crafted request. NOTE: this is probably a duplicate of CVE-2008-5412.

CVE-2009-0432 [MEDIUM] CWE-16 CVE-2009-0432: The installation process for the File Transfer servlet in the System Management/Repository component The installation process for the File Transfer servlet in the System Management/Repository component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.19 does not enable the secure version, which allows remote attackers to obtain sensitive information via unspecified vectors.

CVE-2008-4284 [MEDIUM] CWE-59 CVE-2008-4284: Open redirect vulnerability in the ibm_security_logout servlet in IBM WebSphere Application Server ( Open redirect vulnerability in the ibm_security_logout servlet in IBM WebSphere Application Server (WAS) 5.1.1.19 and earlier 5.x versions, 6.0.x before 6.0.2.33, and 6.1.x before 6.1.0.23 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage feature.

CVE-2009-0435 [MEDIUM] CVE-2009-0435: Unspecified vulnerability in the IBM Asynchronous I/O (aka AIO or libibmaio) library in the Java Mes Unspecified vulnerability in the IBM Asynchronous I/O (aka AIO or libibmaio) library in the Java Message Service (JMS) component in IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.17 on AIX 5.3 allows attackers to cause a denial of service (daemon crash) via vectors related to the aio_getioev2 and getEvent methods.