| Max CVSS | 10.0 | Min CVSS | 2.1 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2009-0855 | 4.3 |
Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
|
02-12-2022 - 18:15 | 09-03-2009 - 21:30 | |
| CVE-2009-0892 | 5.5 |
The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout.
|
17-08-2017 - 01:30 | 31-03-2009 - 14:09 | |
| CVE-2009-0891 | 5.5 |
The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),and 6.0.2 before Fix Pack 33 (6.0.2.33) does not properly enforce (1) nonce and (2) timestamp expiration values
|
17-08-2017 - 01:30 | 25-03-2009 - 01:30 | |
| CVE-2009-1174 | 10.0 |
The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 and 7.0 before 7.0.0.3 has an unspecified "security problem" in the XML digital-signature specification, which has unknown impact and attack vectors.
|
07-09-2016 - 15:27 | 31-03-2009 - 14:09 | |
| CVE-2009-1173 | 2.1 |
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3 uses weak permissions (777) for files associated with unspecified "interim fixes," which allows attackers to modify files that would not have been accessible if the intended 755 permissions we
|
24-10-2014 - 05:37 | 31-03-2009 - 14:09 | |
| CVE-2009-1172 | 10.0 |
The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has u
|
24-10-2014 - 05:37 | 31-03-2009 - 14:09 |