CVE-2009-1172

The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has unknown impact and attack vectors.

• CWE-20

• http://secunia.com/advisories/34131Vendor Advisory
• http://secunia.com/advisories/34461Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PK75992
• http://www-01.ibm.com/support/docview.wss?uid=swg21367223
• http://www-01.ibm.com/support/docview.wss?uid=swg27007951Patch
• http://www-01.ibm.com/support/docview.wss?uid=swg27014463Patch
• http://www.securityfocus.com/bid/34502
• http://secunia.com/advisories/34131Vendor Advisory
• http://secunia.com/advisories/34461Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PK75992
• http://www-01.ibm.com/support/docview.wss?uid=swg21367223
• http://www-01.ibm.com/support/docview.wss?uid=swg27007951Patch
• http://www-01.ibm.com/support/docview.wss?uid=swg27014463Patch
• http://www.securityfocus.com/bid/34502

Published

Mar 31, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1166The administrative web interface on the Cisco Wireless LAN C…
• CVE-2009-1167Unspecified vulnerability on the Cisco Wireless LAN Controll…
• CVE-2009-1168Cisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 thr…
• CVE-2009-1169The txMozillaXSLTProcessor::TransformToDoc function in Mozil…
• CVE-2009-1170Unspecified vulnerability in Sun OpenSolaris snv_100 through…
• CVE-2009-1171The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7…
• CVE-2009-1173IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3 us…
• CVE-2009-1174The Web Services Security component in IBM WebSphere Applica…
• CVE-2009-1175Cross-site scripting (XSS) vulnerability in apps/web/vs_diag…
• CVE-2009-1176mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x …
• CVE-2009-1177Multiple stack-based buffer overflows in maptemplate.c in ma…
• CVE-2009-1178Unspecified vulnerability in the server in IBM Tivoli Storag…