CVE-2009-0899

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4, IBM WebSphere Portal Server 5.1 through 6.0, and IBM Integrated Solutions Console (ISC) 6.0.1 do not properly set the IsSecurityEnabled security flag during migration of WebSphere Member Manager (WMM) to Virtual Member Manager (VMM) and a Federated Repository, which allows attackers to obtain sensitive information from repositories via unspecified vectors.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg21375859Patch, Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1PK78134Vendor Advisory
http://www.securityfocus.com/bid/35406Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/50882Third Party Advisory, VDB Entry
http://www-01.ibm.com/support/docview.wss?uid=swg21375859Patch, Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1PK78134Vendor Advisory
http://www.securityfocus.com/bid/35406Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/50882Third Party Advisory, VDB Entry

Timeline

Published: Jun 3, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-09004.1Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local users to gain privileges CVE-2009-09018.8The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 an CVE-2009-09037.5IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Secu CVE-2009-09046.4The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly p CVE-2009-09051.7IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow local users to gain CVE-2009-09066.5The Service Component Architecture (SCA) feature pack for IBM WebSphere Application Server (WAS) SCA 1.0 before 1.0.0.3 allows remote authen CVE-2009-09086.4Unspecified vulnerability in the ACE shared folders implementation in the VMware Host Guest File System (HGFS) shared folders feature in VMw CVE-2009-09099.3Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 1 CVE-2009-09106.8Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 1 CVE-2009-09127.2perl-MDK-Common 1.1.11 and 1.1.24, 1.2.9 through 1.2.14, and possibly other versions, in Mandriva Linux does not properly handle strings whe CVE-2009-09134.7Unspecified vulnerability in the keysock kernel module in Solaris 10 and OpenSolaris builds snv_01 through snv_108 allows local users to cau CVE-2009-09149.3Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption.