we track for your security since 1999

vulnerabilities

The Vigil@nce team watches vulnerabilities impacting your computers, and then offers solutions, a database and tools to correct them.

recent vulnerabilities

tracked products

RSS feed

vulnerability

vulnerability note CVE-2012-0193 CVE-2012-0717 CVE-2012-2161

WebSphere AS 8.0: five vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of WebSphere Application Server.
Impacted products: WebSphere AS.
Severity: 2/4.
Creation date: 06/08/2012.
Revision date: 07/08/2012.
Identifiers: BID-52724, BID-53755, BID-54051, BID-54819, BID-55149, BID-55185, CVE-2012-0193, CVE-2012-0717, CVE-2012-2161, CVE-2012-2170, CVE-2012-2190, CVE-2012-2191, CVE-2012-3293, PM52351, PM53930, PM56183, PM60839, PM62795, PM66218, swg21587015, swg21606096, swg27022958, VIGILANCE-VUL-11824.

Description of the vulnerability

Five vulnerabilities were announced in WebSphere Application Server.

An attacker can obtain information via Application Snoop Servlet. [severity:1/4; BID-53755, CVE-2012-2170, PM56183]

An attacker can use a Cross Frame Scripting on the administrative console. [severity:2/4; BID-54819, BID-55149, CVE-2012-3293, PM60839]

An attacker can send data generating storage collisions, in order to overload a service (VIGILANCE-VUL-11254). [severity:2/4; CVE-2012-0193, PM53930]

An attacker can bypass the authentication using a SSL client certificate. [severity:2/4; BID-52724, CVE-2012-0717, PM52351, swg21587015]

An attacker can send malicious SSL packets, in order to create a denial of service (VIGILANCE-VUL-12037 and VIGILANCE-VUL-12038). [severity:2/4; BID-55185, CVE-2012-2190, CVE-2012-2191, PM66218]

An attacker can use iehs.war to generate a Cross Site Scripting in WebSphere Application Server, in order to execute JavaScript code in the context of the victim's web browser (VIGILANCE-VUL-11687). [severity:2/4; BID-54051, CVE-2012-2161, PM62795]
Complete Vigil@nce bulletin.... (free access)

Share this bulletin

Computer vulnerabilities tracking service

Vigil@nce provides a computer vulnerability announce. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. The Vigil@nce vulnerability database contains several thousand vulnerabilities. The technology watch team tracks security threats targeting the computer system.