IBM WebSphere Application Server allows remote attackers

Overview :
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caused by sending a specially-crafted URL. This can lead the attacker to view any file in a certain directory. IBM X-Force ID: 164364.
Affected Product(s) :
  • IBM WebSphere Application Server 7.0
  • IBM WebSphere Application Server 8.0
  • IBM WebSphere Application Server  8.5
  • IBM WebSphere Application Server 9.0
Vulnerability Details :
CVE ID : CVE-2019-4505
remote attacker to obtain sensitive information

Solution / Fixes : 

The recommended solution is to apply the interim fix, Fix Pack or PTF containing the APAR for each named product as soon as practical.

For WebSphere Application Server traditional and WebSphere Application Server Hypervisor Edition:

For V9.0.0.0 through 9.0.5.0:
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PH14796
–OR–
· Apply Fix Pack 9.0.5.1 or later (targeted availability 3Q2019).

For V8.5.0.0 through 8.5.5.16:
· Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PH14796
–OR–
· Apply Fix Pack 8.5.5.17 or later (targeted availability 1Q 2020).

For WebSphere Virtual Enterprise Edition:

For V7.0:
· Apply interim fix PH14796

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2022-3270 : FESTO VTEM-S1 INSUFFICIENT TECHNICAL DOCUMENTATION

CVE-2022-3270 : FESTO VTEM-S1 INSUFFICIENT TECHNICAL DOCUMENTATION

Description In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead

CVE-2022-4221 : ASUS NAS-M25 UP TO 1.0.1.7 COOKIE OS COMMAND INJECTION

CVE-2022-4221 : ASUS NAS-M25 UP TO 1.0.1.7 COOKIE OS COMMAND INJECTION

Description Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability in Asus NAS-M25 allows an

CVE-2022-45045 : XIONGMAI MBD6304T/NBD6808T-PL JSON FILE DESERIALIZATION

CVE-2022-45045 : XIONGMAI MBD6304T/NBD6808T-PL JSON FILE DESERIALIZATION

Description Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root,