Advisories
Vulnerability Database
PoC
Viruses
Research Lab

CVE-2010-0563


Published: 08-02-2010
Updated: 10-02-2010

Product:
ibm: websphere_application_server 7.0
ibm: websphere_application_server 7.0.0.1
ibm: websphere_application_server 7.0.0.2
ibm: websphere_application_server 7.0.0.3
ibm: websphere_application_server 7.0.0.4
ibm: websphere_application_server 7.0.0.5
ibm: websphere_application_server 7.0.0.6
ibm: websphere_application_server 7.0.0.7
ibm: websphere_application_server 7.0.0.8

Severity: Medium (5.0)

CVSS vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Potential loss type: Confidentiality

Vulnerability description:
The Single Sign-on (SSO) functionality in IBM WebSphere Application Server (WAS) 7.0.0.0 through 7.0.0.8 does not recognize the Requires SSL configuration option, which might allow remote attackers to obtain sensitive information by sniffing network sessions that were expected to be encrypted.

Patch available: Yes

References:
CONFIRM: http://www-01.ibm.com/support/docview.wss?uid=swg21417839
BID: http://www.securityfocus.com/bid/38122
OSVDB: http://www.osvdb.org/62140
AIXAPAR: http://www-1.ibm.com/support/docview.wss?uid=swg1PM00610
SECTRACK: http://securitytracker.com/id?1023551
SECUNIA: http://secunia.com/advisories/38425

Cisco Security Advisory: Multiple Vulnerabilities in Cisco IronPort Encryption Appliance

Cisco IronPort Encryption Appliance devices contain two vulnerabilities that allow remote, unauthent ...

11 february, 2010

Cisco Security Advisory: Multiple Cisco WebEx WRF Player Vulnerabilities

Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Recording Format (WRF) Pla ...

18 december, 2009

Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability

An industry-wide vulnerability exists in the Transport Layer Security (TLS) protocol that co ...

23 november, 2009

MS10-017: Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (980150)

This security update resolves seven privately reported vulnerabilities in Microsoft Office Excel.

09 march, 2010

MS10-016: Vulnerability in Windows Movie Maker Could Allow Remote Code Execution (975561)

This security update addresses a privately reported vulnerability in Windows Movie Maker and Microso ...

09 march, 2010

MS10-015: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (977165)

This security update resolves one publicly disclosed and one privately reported vulnerability in Mic ...

10 february, 2010

CVE-2009-4718

SQL injection vulnerability in visitorduration.php in Gonafish WebStatCaffe allows remote attackers to execute arbitrary SQL commands via the nodayshow parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

National Vulnerability Database 15 march, 2010

CVE-2009-4717

Multiple cross-site scripting (XSS) vulnerabilities in Gonafish WebStatCaffe allow remote attackers to inject arbitrary web script or HTML via the (1) host parameter to stat/host.php, nodayshow parameter to (2) mostvisitpage.php and (3) visitorduration.php in stat/, (4) nopagesmost parameter to stat/mostvisitpagechart.php, and date parameter to (5) pageviewers.php, (6) pageviewerschart.php, and (7) referer.php in stat/.

National Vulnerability Database 15 march, 2010

CVE-2009-4716

Cross-site scripting (XSS) vulnerability in results.php in EDGEPHP EZWebSearch allows remote attackers to inject arbitrary web script or HTML via the language parameter.

National Vulnerability Database 15 march, 2010

CVE-2009-4715

Cross-site scripting (XSS) vulnerability in rates.php in Real Time Currency Exchange allows remote attackers to inject arbitrary web script or HTML via the Amount parameter.

National Vulnerability Database 15 march, 2010

CVE-2009-4714

Cross-site scripting (XSS) vulnerability in the quiz module for XOOPS Celepar allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to cadastro_usuario.php.

National Vulnerability Database 15 march, 2010

CVE-2009-4713

Multiple cross-site scripting (XSS) vulnerabilities in the Qas (aka Quas) module for XOOPS Celepar allow remote attackers to inject arbitrary web script or HTML via (1) the cod_categoria parameter to categoria.php, (2) the opcao parameter to index.php, and the PATH_INFO to (3) categoria.php and (4) index.php.

National Vulnerability Database 15 march, 2010

CVE-2009-4712

SQL injection vulnerability in index.php in Tukanas Classifieds (aka EasyClassifieds) Script 1.0 allows remote attackers to execute arbitrary SQL commands via the b parameter.

National Vulnerability Database 15 march, 2010

CVE-2009-4711

SQL injection vulnerability in the CoolURI (cooluri) extension before 1.0.16 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2008-6686.

National Vulnerability Database 15 march, 2010

CVE-2009-4710

SQL injection vulnerability in the Reset backend password (cwt_resetbepassword) extension 1.20 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

National Vulnerability Database 15 march, 2010

CVE-2009-4709

SQL injection vulnerability in the datamints Newsticker (datamints_newsticker) extension before 0.7.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

National Vulnerability Database 15 march, 2010

CVE-2009-4708

SQL injection vulnerability in the [Gobernalia] Front End News Submitter (gb_fenewssubmit) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

National Vulnerability Database 15 march, 2010

CVE-2009-4707

Cross-site scripting (XSS) vulnerability in the [Gobernalia] Front End News Submitter (gb_fenewssubmit) extension 0.1.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

National Vulnerability Database 15 march, 2010

CVE-2009-4706

Cross-site scripting (XSS) vulnerability in the Mailform (mailform) extension before 0.9.24 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

National Vulnerability Database 15 march, 2010

CVE-2009-4705

Cross-site scripting (XSS) vulnerability in the Twitter Search (twittersearch) extension before 0.1.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

National Vulnerability Database 15 march, 2010

CVE-2009-4704

Unspecified vulnerability in the Webesse E-Card (ws_ecard) extension 1.0.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.

National Vulnerability Database 15 march, 2010
Search
Sun Microsystems

SunOS 5.10_x86: ucode driver patch

6905530 processor microcode code can panic when retrieving microcode revision.

02 february, 2010

Security Vulnerabilities in PostgreSQL Shipped With Solaris May Allow Escalation of Privileges or Man-in-the-Middle on SSL Connections

Multiple security vulnerabilities have been identified in the PostgreSQL software shipped with Solar ...

31 december, 2009

Directory Proxy Server Provided with Directory Server Enterprise Edition 6 is Subject to Denial of Service (DoS) and May Allow Unauthorized Access to Certain Data

Directory Proxy Server Provided with Directory Server Enterprise Edition 6 is Subject to Denial of S ...

31 december, 2009

Red Hat

[RHSA-2010:0130-01] Moderate: java-1.5.0-ibm security update

Red Hat Security Advisory - Moderate: java-1.5.0-ibm security update

03 march, 2010

[RHSA-2010:0129-01] Moderate: cups security update

Red Hat Security Advisory - Moderate: cups security update

03 march, 2010

[RHSA-2010:0126-01] Important: kvm security and bug fix update

Red Hat Security Advisory - Important: kvm security and bug fix update

01 march, 2010

╨ю╤

Microsoft Windows 2000/XP CHM Notepad Remote Code Execution PoC

Target: Microsoft Windows 2000/XP
Impact: Denial of service

Microsoft Internet Explorer iepeers.dll Use After Free Exploit (meta)

Target: Microsoft Internet Explorer 6.x, 7.x
Impact: Code execution

MS05-20 Internet Explorer DHTML Memory Corruption PoC

Target: Internet Explorer
Impact: Denial of service

AdvertismentAbout ProjectContact UsCopyrightExportRSSMy SettingsMap