CVE-2009-0504

WSPolicy in the Web Services component in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.1 does not properly recognize the IDAssertion.isUsed binding property, which allows local users to discover a password by reading a SOAP message.

• CWE-200

• http://www-01.ibm.com/support/docview.wss?uid=swg27014463Patch, Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK73573Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48700
• http://www-01.ibm.com/support/docview.wss?uid=swg27014463Patch, Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK73573Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48700

Published

Feb 17, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0498Virtual GuestBook (vgbook) 2.1 stores sensitive information …
• CVE-2009-0499Cross-site request forgery (CSRF) vulnerability in the forum…
• CVE-2009-0500Cross-site scripting (XSS) vulnerability in course/lib.php i…
• CVE-2009-0501Unspecified vulnerability in the Calendar export feature in …
• CVE-2009-0502Cross-site scripting (XSS) vulnerability in blocks/html/bloc…
• CVE-2009-0503IBM WebSphere Message Broker 6.1.x before 6.1.0.2 writes a d…
• CVE-2009-0505The CICS listener in IBM TXSeries for Multiplatforms 6.2 GA …
• CVE-2009-0506Unspecified vulnerability in IBM WebSphere Application Serve…
• CVE-2009-0507IBM WebSphere Process Server (WPS) 6.1.2 before 6.1.2.3 and …
• CVE-2009-0508The Servlet Engine/Web Container and JSP components in IBM W…
• CVE-2009-0509Heap-based buffer overflow in the JBIG2 filter in Adobe Read…
• CVE-2009-0510Heap-based buffer overflow in the JBIG2 filter in Adobe Read…