IBM WebSphere Application Server 8.0 before Fix Pack 8 appears to be running on the remote host.  It is, therefore, potentially affected by the following vulnerabilities :

  - A CSRF vulnerability exists in IBM WebSphere Application     Server due to improper validation of portlets in the     Administrative console. (CVE-2013-0460, PM72275)

  - A privilege escalation vulnerability exists on IBM     WebSphere Application Servers using WS-Security that are     configured for XML Digital Signature using trust store.
    (CVE-2013-4053, PM90949, PM91521)

  - An XSS vulnerability exists in IBM WebSphere Application     Server caused by a failure to sanitize user-supplied     input in the UDDI Administrative console.
    (CVE-2013-4052, PM91892)

  - A privilege escalation vulnerability exists in IBM     WebSphere Application Servers that have been migrated     from version 6.1 or later. (CVE-2013-5414, PM92313)

  - An XSS vulnerability exists in IBM WebSphere Application     Server due to a failure to sanitize application HTTP     response data. (CVE-2013-5417, PM93323, PM93944)

  - An XSS vulnerability exists in IBM WebSphere Application     Server due to a failure to sanitize user-supplied input     in the Administrative console. (CVE-2013-5418, PM96477)

  - An XSS vulnerability exists in IBM WebSphere Application     Server due to a failure to sanitize user-supplied input     in the Administrative console. (CVE-2013-6725, PM98132)

  - A denial of service vulnerability exists in IBM     WebSphere Application Server due to a failure to     properly handle requests by a web services endpoint.
    (CVE-2013-6325, PM99450)

  - An information disclosure vulnerability exists in the     IBM SDK for Java that ships with IBM WebSphere     Application Server related to JSSE. (CVE-2013-5780)

  - A denial of service vulnerability exists in the IBM SDK     for Java that ships with IBM WebSphere Application     Server related to XML. (CVE-2013-5372)

  - A denial of service vulnerability exists in the IBM SDK     for Java that ships with IBM WebSphere Application     Server related to JSSE. (CVE-2013-5803)

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.4, 5.5 and 5.6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Network Satellite Server 5.4, 5.5 and 5.6. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets.

Several flaws were fixed in the IBM Java 2 Runtime Environment.
(CVE-2013-3829, CVE-2013-4041, CVE-2013-5372, CVE-2013-5375, CVE-2013-5457, CVE-2013-5772, CVE-2013-5774, CVE-2013-5776, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5789, CVE-2013-5797, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5851)

Users of Red Hat Network Satellite Server 5.4, 5.5 and 5.6 are advised to upgrade to these updated packages, which contain the IBM Java SE 6 SR15 release. For this update to take effect, Red Hat Network Satellite Server must be restarted ('/usr/sbin/rhn-satellite restart'), as well as all running instances of IBM Java.

ID	名稱	產品	系列	已發布	已更新	嚴重性
72062	IBM WebSphere Application Server 8.0 < Fix Pack 8 Multiple Vulnerabilities	Nessus	Web Servers	2014/1/20	2018/8/6	medium
78984	RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1793)	Nessus	Red Hat Local Security Checks	2014/11/8	2021/1/14	critical

偵測

搜尋 Plugin

medium

critical