Ibm Websphere Portal vulnerabilities

126 known vulnerabilities affecting ibm/websphere_portal.

Total CVEs

126

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

CRITICAL1HIGH15MEDIUM95LOW15

Vulnerabilities

Page 4 of 7

CVE-2014-6215LOWCVSS 3.5v6.1.0v6.1.0.1+11 more2014-12-11

CVE-2014-6215 [LOW] CWE-79 CVE-2014-6215: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 t Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 before 7.0.0.2 CF29, 8.0.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

nvd

CVE-2014-6093LOWCVSS 3.5≤ 7.0.0.2≤ 8.0.0.1+4 more2014-11-26

CVE-2014-6093 [LOW] CWE-79 CVE-2014-6093: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x th Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

nvd

CVE-2014-4821MEDIUMCVSS 5.0v6.1.0.0v6.1.0.1+15 more2014-10-28

CVE-2014-4821 [MEDIUM] CWE-200 CVE-2014-4821: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF2 IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 provides different web-server error codes depending on whether a requested file exists, which allows remote attackers to determine the validity of filenames via a series of requests.

nvd

CVE-2014-4808MEDIUMCVSS 6.5v6.1.0.0v6.1.0.1+14 more2014-10-28

CVE-2014-4808 [MEDIUM] CVE-2014-4808: Unspecified vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 Unspecified vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 allows remote authenticated users to execute arbitrary code via unknown vectors.

nvd

CVE-2014-6126MEDIUMCVSS 4.3v8.5.0.02014-10-28

CVE-2014-6126 [MEDIUM] CWE-79 CVE-2014-6126: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF03 allows remote att Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

nvd

CVE-2014-6125MEDIUMCVSS 6.8v8.5.0.02014-10-28

CVE-2014-6125 [MEDIUM] CWE-352 CVE-2014-6125: Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Portal 8.5.0 before CF03 allows rem Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Portal 8.5.0 before CF03 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

nvd

CVE-2014-4814LOWCVSS 3.5v6.1.0.0v6.1.0.1+15 more2014-10-28

CVE-2014-4814 [LOW] CVE-2014-4814: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF2 IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 through 8.0.0.1 CF14, and 8.5.0 before CF03 does not properly detect recursion during entity expansion, which allows remote authenticated users to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of

nvd

CVE-2014-4761MEDIUMCVSS 4.0v6.1.0.0v6.1.0.1+16 more2014-10-10

CVE-2014-4761 [MEDIUM] CWE-200 CVE-2014-4761: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF2 IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0 through 7.0.0.2 CF28, 8.0 before 8.0.0.1 CF14, and 8.5.0 through 8.5.0.0 CF02 allows remote authenticated users to discover credentials by reading HTML source code.

nvd

CVE-2014-4792MEDIUMCVSS 4.0v6.0.0.0v6.0.0.1+19 more2014-09-12

CVE-2014-4792 [MEDIUM] CWE-399 CVE-2014-4792: IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 C IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, 8.0.0 through 8.0.0.1 CF13, and 8.5.0 before CF02 allows remote authenticated users to cause a denial of service (disk consumption) by uploading large files.

nvd

CVE-2014-4762LOWCVSS 3.5v8.0v8.0.0.0+2 more2014-09-12

CVE-2014-4762 [LOW] CWE-79 CVE-2014-4762: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF13 and 8.5. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF13 and 8.5.0 before CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

nvd

CVE-2014-0953MEDIUMCVSS 4.3v6.1.0.0v6.1.0.1+13 more2014-08-12

CVE-2014-0953 [MEDIUM] CWE-79 CVE-2014-0953: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5 Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, and 8.0.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

nvd

CVE-2014-4746MEDIUMCVSS 5.0v8.0.0.0v8.5.0.02014-08-12

CVE-2014-4746 [MEDIUM] CWE-200 CVE-2014-4746: IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF13 and 8.5.0 through CF01 provides different error codes IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF13 and 8.5.0 through CF01 provides different error codes for firewall-traversal requests depending on whether the intranet host exists, which allows remote attackers to map the intranet network via a series of requests.

nvd

CVE-2014-4760MEDIUMCVSS 5.8v6.1.0.0v6.1.0.1+14 more2014-08-12

CVE-2014-4760 [MEDIUM] CVE-2014-4760: Open redirect vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6. Open redirect vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF28, 8.0.0 before 8.0.0.1 CF13, and 8.5.0 before CF01 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.

nvd

CVE-2014-3102LOWCVSS 3.5v7.0.0.0v7.0.0.1+2 more2014-08-12

CVE-2014-3102 [LOW] CWE-79 CVE-2014-3102: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF28 and 8.0. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF28 and 8.0.0 before 8.0.0.1 CF13 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

nvd

CVE-2014-3055HIGHCVSS 7.5v7.0.0.0v7.0.0.1+3 more2014-07-29

CVE-2014-3055 [HIGH] CWE-89 CVE-2014-3055: SQL injection vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and SQL injection vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

nvd

CVE-2014-3057MEDIUMCVSS 4.3v7.0.0.0v7.0.0.1+3 more2014-07-29

CVE-2014-3057 [MEDIUM] CWE-79 CVE-2014-3057: Cross-site scripting (XSS) vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Po Cross-site scripting (XSS) vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

nvd

CVE-2014-3056MEDIUMCVSS 5.0v7.0.0.0v7.0.0.1+3 more2014-07-29

CVE-2014-3056 [MEDIUM] CWE-200 CVE-2014-3056: The Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows The Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to obtain potentially sensitive information about environment variables and JAR versions via unspecified vectors.

nvd

CVE-2014-3054MEDIUMCVSS 5.8v7.0.0.0v7.0.0.1+3 more2014-07-29

CVE-2014-3054 [MEDIUM] CVE-2014-3054: Multiple open redirect vulnerabilities in the Unified Task List (UTL) Portlet for IBM WebSphere Port Multiple open redirect vulnerabilities in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

nvd

CVE-2014-0910LOWCVSS 3.5PoCv7.0.0.0v7.0.0.1+12 more2014-06-18

CVE-2014-0910 [LOW] CWE-79 CVE-2014-0910: Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5 Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.0 through 6.1.0.6 CF27, 6.1.5.0 through 6.1.5.3 CF27, and 7.0.0 through 7.0.0.2 CF28 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

nvd

CVE-2014-0951MEDIUMCVSS 4.3v6.1.0.6v6.1.5.3+5 more2014-05-22

CVE-2014-0951 [MEDIUM] CWE-79 CVE-2014-0951: Cross-site scripting (XSS) vulnerability in FilterForm.jsp in IBM WebSphere Portal 7.0 before 7.0.0. Cross-site scripting (XSS) vulnerability in FilterForm.jsp in IBM WebSphere Portal 7.0 before 7.0.0.2 CF28 and 8.0 before 8.0.0.1 CF12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

nvd

← Previous4 / 7Next →