6.0 : Security Vulnerabilities

Cpe Name:cpe:/a:ibm:websphere_mq:6.0

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2011-1378	264		2011-11-25	2012-01-17	1.9	None	Local	Medium	Not required	None	None	Partial
IBM WebSphere MQ 6.0 on OpenVMS, when the default rights of the MQM group are established, does not properly verify User Authorization File (UAF) data, which allows local users to kill listener processes and the command server via a control command.
2	CVE-2011-1224	264		2011-07-07	2011-07-08	4.3	None	Remote	Medium	Not required	None	Partial	None
IBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 does not use the CRL Distribution Points (CDP) certificate extension, which might allow man-in-the-middle attackers to spoof an SSL partner via a revoked certificate for a (1) client, (2) queue manager, or (3) application.
3	CVE-2011-0314	119	DoS Exec Code Overflow	2011-01-11	2011-01-20	6.5	None	Remote	Low	Single system	Partial	Partial	Partial
Heap-based buffer overflow in IBM WebSphere MQ 6.0 before 6.0.2.11 and 7.0 before 7.0.1.5 allows remote authenticated users to execute arbitrary code or cause a denial of service (queue manager crash) by inserting an invalid message into the queue.
4	CVE-2010-2637	310	+Info	2010-11-12	2010-12-01	4.3	None	Remote	Medium	Not required	Partial	None	None
IBM WebSphere MQ 6.0 before 6.0.2.9 and 7.0 before 7.0.1.1 does not encrypt the username and password in the security parameters field, which allows remote attackers to obtain sensitive information by sniffing the network traffic from a .NET client application.
5	CVE-2010-0782			2010-10-20	2010-10-21	4.3	None	Remote	Medium	Not required	None	Partial	None
IBM WebSphere MQ 6.x before 6.0.2.10 and 7.x before 7.0.1.3 allows remote attackers to spoof X.509 certificate authentication, and send or receive channel messages, via a crafted Subject Distinguished Name (DN) value in a certificate.
6	CVE-2009-3160			2009-09-10	2009-10-01	8.8	None	Remote	Medium	Not required	None	Complete	Complete
IBM WebSphere MQ 6.x through 6.0.2.7, 7.0.0.0, 7.0.0.1, 7.0.0.2, and 7.0.1.0, when read ahead or asynchronous message consumption is enabled, allows attackers to have an unspecified impact via unknown vectors, related to a "memory overwrite" issue.
7	CVE-2009-0905	20	+Priv	2011-10-30	2012-02-29	1.7	None	Local	Low	Single system	None	Partial	None
IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow local users to gain privileges by leveraging combinations of group names with the same initial substring.
8	CVE-2009-0900	119	Overflow +Priv	2011-10-30	2012-02-29	4.1	None	Local	Medium	Single system	Partial	Partial	Partial
Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local users to gain privileges via crafted SSL information in a Client Channel Definition Table (CCDT) file.
9	CVE-2009-0896	119	Exec Code Overflow	2009-06-03	2009-06-03	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in the queue manager in IBM WebSphere MQ 6.x before 6.0.2.7 and 7.x before 7.0.1.0 allows remote attackers to execute arbitrary code via a crafted request.
10	CVE-2007-6044	399	Mem. Corr.	2007-11-20	2008-11-15	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in IBM WebSphere MQ 6.0 have unknown impact and remote attack vectors involving "memory corruption." NOTE: as of 20071116, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes.

Total number of vulnerabilities : 10 Page : 1 (This Page)