CVE-2009-0903

IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remote attackers to bypass intended access restrictions via a crafted request to a JAX-WS application.

• http://www-1.ibm.com/support/docview.wss?uid=swg1PK72138
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK81944Patch, Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK87767Patch, Vendor Advisory
• http://www.securityfocus.com/bid/35594
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51293
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK72138
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK81944Patch, Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1PK87767Patch, Vendor Advisory
• http://www.securityfocus.com/bid/35594
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51293

Published

Jun 25, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0896Buffer overflow in the queue manager in IBM WebSphere MQ 6.x…
• CVE-2009-0897IBM WebSphere Partner Gateway (WPG) 6.1.0 before 6.1.0.1 and…
• CVE-2009-0898Stack-based buffer overflow in HP OpenView Network Node Mana…
• CVE-2009-0899IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 …
• CVE-2009-0900Heap-based buffer overflow in the client in IBM WebSphere MQ…
• CVE-2009-0901The Active Template Library (ATL) in Microsoft Visual Studio…8.8
• CVE-2009-0904The IBM Stax XMLStreamWriter in the Web Services component i…
• CVE-2009-0905IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 d…
• CVE-2009-0906The Service Component Architecture (SCA) feature pack for IB…
• CVE-2009-0907Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2009-0908Unspecified vulnerability in the ACE shared folders implemen…
• CVE-2009-0909Heap-based buffer overflow in the VNnc Codec in VMware Works…