Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Websphere_message_broker
(Ibm)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 23 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2019-02-04 | CVE-2018-1801 | IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker V8.0.0.0 through V8.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to consume memory resources. IBM X-Force ID: 149639. | App_connect, Integration_bus, Websphere_message_broker | 5.3 | ||
| 2018-11-26 | CVE-2017-1418 | IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0.9) has insecure permissions on certain files. A local attacker could exploit this vulnerability to modify or delete these files with an unknown impact. IBM X-Force ID: 127406. | Integration_bus, Websphere_message_broker | 5.5 | ||
| 2017-07-05 | CVE-2017-1207 | IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777. | Integration_bus, Websphere_message_broker | 5.5 | ||
| 2017-07-05 | CVE-2017-1144 | IBM WebSphere Message Broker could allow a local user with specialized access to prevent the message broker from starting. IBM X-Force ID: 122033. | Integration_bus, Websphere_message_broker | 2.5 | ||
| 2017-10-03 | CVE-2017-1126 | IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that could lead to further attacks. IBM X-Force ID: 121341. | Integration_bus, Websphere_message_broker | 5.3 | ||
| 2017-02-15 | CVE-2016-9706 | IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1997918. | Integration_bus, Websphere_message_broker | 9.1 | ||
| 2017-02-15 | CVE-2016-9010 | IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM Reference #: 1997906. | Integration_bus, Websphere_message_broker | 6.1 | ||
| 2017-02-01 | CVE-2016-6080 | The WebAdmin context for WebSphere Message Broker allows directory listings which could disclose sensitive information to the attacker. | Websphere_message_broker | 5.3 | ||
| 2016-07-02 | CVE-2016-2961 | The integration server in IBM Integration Bus 9 before 9.0.0.6 and 10 before 10.0.0.5 and WebSphere Message Broker 8 before 8.0.0.8 allows remote attackers to obtain sensitive Tomcat version information by sending a malformed POST request and then reading the Java stack trace. | Integration_bus, Websphere_message_broker | 5.3 | ||
| 2017-02-01 | CVE-2016-0394 | IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files. | Integration_bus, Websphere_message_broker | 3.3 |