CVE-2014-0891

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.33, 8.0.x before 8.0.0.9, and 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information by leveraging incorrect request handling by the (1) Proxy or (2) ODR server.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg1PI09786
http://www-01.ibm.com/support/docview.wss?uid=swg21669554Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676091Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676092Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/91286
http://www-01.ibm.com/support/docview.wss?uid=swg1PI09786
http://www-01.ibm.com/support/docview.wss?uid=swg21669554Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676091Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676092Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/91286

Timeline

Published: Jun 28, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-08925.0IBM Notes and Domino 8.5.x before 8.5.3 FP6 IF3 and 9.x before 9.0.1 FP1 on 32-bit Linux platforms use incorrect gcc options, which makes it CVE-2014-08934.3Cross-site scripting (XSS) vulnerability in customreport.jsp in IBM Maximo Asset Management 7.5.x before 7.5.0.5 IFIX006 and SmartCloud Cont CVE-2014-08943.5RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM Algorithmics allows context-dependent attackers to CVE-2014-08957.5Buffer overflow in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 3.0.1-IM-S3SAMPC-WIN32-FP001-IF02 allows remote att CVE-2014-08964.3IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.2 allows remote attackers to obtain sensitive information via a cr CVE-2014-08973.5The Configuration Patterns component in IBM Flex System Manager (FSM) 1.2.0.x, 1.2.1.x, 1.3.0.x, and 1.3.1.x uses a weak algorithm in an enc CVE-2014-08996.5ftpd in IBM AIX 7.1.1 before SP10 and 7.1.2 before SP5, when a Workload Partition (aka WPAR) for AIX 5.2 or 5.3 is used, allows remote authe CVE-2014-09008.8The Device Administrator code in Android before 4.4.1_r1 might allow attackers to spoof device administrators and consequently bypass MDM re CVE-2014-09013.5Cross-site scripting (XSS) vulnerability in the Social Rendering implementation in the IBM Connections integration in IBM WebSphere Portal 8 CVE-2014-09047.6The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remo CVE-2014-09052.9IBM InfoSphere BigInsights 2.0 through 2.1.2 does not set the secure flag for the LTPA cookie in an https session, which makes it easier for CVE-2014-09064.3The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not check whether a session cookie is current, which all