Kin Hung Cheng

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server versions 8.5 through 9.0 **Description** The issue allows a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code on the system using specially crafted input. **Recommendations** For IBM WebSphere Application Server versions 8.5 through 9.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IBM WebSphere Application Server versions 8.5 through 9.0 **Description** The issue allows a privileged user to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session. This is due to a cross-site scripting issue. **Recommendations** For IBM WebSphere Application Server versions 8.5 through 9.0, consider disabling the Web UI functionality until a patch is available to prevent potential exploitation. Restrict access to the Web UI to minimize the risk of credentials disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.