The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of IBM WebSphere Enterprise Service Bus

security vulnerability CVE-2016-2183 CVE-2016-5546 CVE-2016-5547

Oracle Java: vulnerabilities of January 2017

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Oracle Java.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 17.
Creation date: 18/01/2017.
Identifiers: 1998379, 1998858, 1999054, 1999999, 2000212, 2000304, 2000516, 2000544, 2000602, 2000988, 2000990, 2001608, 2002331, 2002335, 2002336, 2002479, 2002537, 2002966, 2002991, 2003145, 2004036, 2004938, 2007242, bulletinapr2017, CERTFR-2017-AVI-017, cpujan2017, CVE-2016-2183, CVE-2016-5546, CVE-2016-5547, CVE-2016-5548, CVE-2016-5549, CVE-2016-5552, CVE-2016-8328, CVE-2017-3231, CVE-2017-3241, CVE-2017-3252, CVE-2017-3253, CVE-2017-3259, CVE-2017-3260, CVE-2017-3261, CVE-2017-3262, CVE-2017-3272, CVE-2017-3289, DLA-802-1, DLA-821-1, DSA-2019-131, DSA-3782-1, ERPSCAN-17-006, ESA-2017-051, FEDORA-2017-4cb58f0bda, FEDORA-2017-c1252ccd41, ibm10718843, java_jan2017_advisory, NTAP-20170119-0001, openSUSE-SU-2017:0374-1, openSUSE-SU-2017:0513-1, RHSA-2017:0175-01, RHSA-2017:0176-01, RHSA-2017:0177-01, RHSA-2017:0180-01, RHSA-2017:0263-01, RHSA-2017:0269-01, RHSA-2017:0336-01, RHSA-2017:0337-01, RHSA-2017:0338-01, RHSA-2017:0462-01, SB10186, SUSE-SU-2017:0346-1, SUSE-SU-2017:0460-1, SUSE-SU-2017:0490-1, SUSE-SU-2017:1444-1, USN-3179-1, USN-3194-1, USN-3198-1, VIGILANCE-VUL-21606, ZDI-17-056, ZDI-17-057.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in Oracle Java.

An attacker can use a vulnerability via Hotspot, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2017-3289, ZDI-17-057]

An attacker can use a vulnerability via Libraries, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2017-3272, ZDI-17-056]

An attacker can use a vulnerability via RMI, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2017-3241]

An attacker can use a vulnerability via AWT, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2017-3260]

An attacker can use a vulnerability via 2D, in order to trigger a denial of service. [severity:3/4; CVE-2017-3253]

An attacker can use a vulnerability via Libraries, in order to alter information. [severity:3/4; CVE-2016-5546]

An attacker can use a vulnerability via Libraries, in order to obtain information. [severity:2/4; CVE-2016-5549]

An attacker can use a vulnerability via Libraries, in order to obtain information. [severity:2/4; CVE-2016-5548]

An attacker can use a vulnerability via JAAS, in order to alter information. [severity:2/4; CVE-2017-3252]

An attacker can use a vulnerability via Java Mission Control, in order to obtain information. [severity:2/4; CVE-2017-3262]

An attacker can use a vulnerability via Libraries, in order to trigger a denial of service. [severity:2/4; CVE-2016-5547]

An attacker can use a vulnerability via Networking, in order to alter information. [severity:2/4; CVE-2016-5552]

An attacker can use a vulnerability via Networking, in order to obtain information. [severity:2/4; CVE-2017-3231]

An attacker can use a vulnerability via Networking, in order to obtain information. [severity:2/4; CVE-2017-3261]

An attacker can use a vulnerability via Deployment, in order to obtain information. [severity:1/4; CVE-2017-3259]

An attacker can use a vulnerability via Java Mission Control, in order to alter information. [severity:1/4; CVE-2016-8328]

An attacker can use a vulnerability via Libraries, in order to obtain information. [severity:1/4; CVE-2016-2183]
Full Vigil@nce bulletin... (Free trial)

threat alert CVE-2016-8919

IBM WebSphere AS: denial of service via a SOAP interface

Synthesis of the vulnerability

An attacker can generate an huge usage of resources via a SOAP interface of IBM WebSphere AS, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 18/01/2017.
Identifiers: 1993797, 1997765, 1997912, 1998432, 7014463, 7036319, CVE-2016-8919, VIGILANCE-VUL-21605.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate an huge usage of resources via a SOAP interface of IBM WebSphere AS, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

security note CVE-2016-0360

IBM WebSphere MQ: code execution via JMSObjectMessage

Synthesis of the vulnerability

An attacker can send packed objects be decoded by JMSObjectMessage of IBM WebSphere MQ, in order to run arbitrary code.
Severity: 3/4.
Creation date: 06/01/2017.
Identifiers: 1983457, 1996748, 2000729, 2000730, 2001510, CVE-2016-0360, VIGILANCE-VUL-21526.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The IBM WebSphere MQ product handles serialized objects via its class JMSObjectMessage.

However, this class does not rightly check the origin of objects and associated classes.

An attacker can therefore send packed objects be decoded by JMSObjectMessage of IBM WebSphere MQ, in order to run arbitrary code.
Full Vigil@nce bulletin... (Free trial)

threat alert CVE-2016-8934

WebSphere AS: Cross Site Scripting via Admin Console

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting via Admin Console of WebSphere AS, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Creation date: 07/12/2016.
Identifiers: 1992315, 1996037, 1996038, 1996145, 1996238, 7014463, 7036319, CVE-2016-8934, VIGILANCE-VUL-21297.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The WebSphere AS product offers a web service.

However, it does not filter received data via Admin Console before inserting them in generated HTML documents.

An attacker can therefore trigger a Cross Site Scripting via Admin Console of WebSphere AS, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

weakness announce CVE-2016-9736

WebSphere AS: information disclosure via SOAP

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via SOAP of WebSphere AS, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 07/12/2016.
Identifiers: 1991469, 1995949, 1996037, 1996038, 1996143, 1996240, CVE-2016-9736, VIGILANCE-VUL-21296.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via SOAP of WebSphere AS, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer weakness alert CVE-2016-5542 CVE-2016-5554 CVE-2016-5556

Oracle Java: vulnerabilities of October 2016

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Oracle Java.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 7.
Creation date: 19/10/2016.
Identifiers: 1993440, 1994049, 1994123, 1994478, 1997764, 1999054, 1999395, 1999474, 1999478, 1999479, 1999488, 1999532, 2000212, 2000544, 2000904, 2000988, 2000990, 2001608, 2002331, 2002479, 2002537, 2003145, 2004036, 491108, CERTFR-2016-AVI-349, CERTFR-2017-AVI-012, cpuoct2016, CVE-2016-5542, CVE-2016-5554, CVE-2016-5556, CVE-2016-5568, CVE-2016-5573, CVE-2016-5582, CVE-2016-5597, DLA-704-1, DSA-3707-1, ESA-2016-137, FEDORA-2016-73054cfeeb, JSA10770, NTAP-20161019-0001, openSUSE-SU-2016:2862-1, openSUSE-SU-2016:2900-1, openSUSE-SU-2016:2985-1, openSUSE-SU-2016:2990-1, openSUSE-SU-2016:3088-1, RHSA-2016:2079-01, RHSA-2016:2088-01, RHSA-2016:2089-01, RHSA-2016:2090-01, RHSA-2016:2136-01, RHSA-2016:2137-01, RHSA-2016:2138-01, RHSA-2016:2658-01, RHSA-2016:2659-01, RHSA-2017:0061-01, SUSE-SU-2016:2887-1, SUSE-SU-2016:3010-1, SUSE-SU-2016:3040-1, SUSE-SU-2016:3041-1, SUSE-SU-2016:3043-1, SUSE-SU-2016:3068-1, SUSE-SU-2016:3078-1, USN-3121-1, USN-3130-1, USN-3154-1, VIGILANCE-VUL-20906, ZDI-16-571.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in Oracle Java.

An attacker can use a vulnerability via 2D, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5556]

An attacker can use a vulnerability via AWT, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5568, ZDI-16-571]

An attacker can use a vulnerability via Hotspot, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5582]

An attacker can use a vulnerability via Hotspot, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5573]

An attacker can use a vulnerability via Networking, in order to obtain information. [severity:2/4; CVE-2016-5597]

An attacker can use a vulnerability via JMX, in order to alter information. [severity:2/4; CVE-2016-5554]

An attacker can use a vulnerability via Libraries, in order to alter information. [severity:1/4; CVE-2016-5542]
Full Vigil@nce bulletin... (Free trial)

computer weakness note CVE-2016-1000031

Apache Commons FileUpload: read-write access

Synthesis of the vulnerability

An attacker can bypass access restrictions of Apache Commons FileUpload, in order to read or alter files.
Severity: 3/4.
Creation date: 18/10/2016.
Identifiers: 2009844, 2011428, 2011689, 528262, 7018113, 7043863, 7048591, CERTFR-2018-AVI-531, cisco-sa-20181107-struts-commons-fileupload, cpuapr2019, cpujan2019, cpujul2019, cpuoct2019, CVE-2016-1000031, DSA-2018-210, openSUSE-SU-2019:1399-1, SUSE-SU-2019:1212-2, SUSE-SU-2019:1214-1, SUSE-SU-2019:14044-1, TRA-2016-12, VIGILANCE-VUL-20892, ZDI-16-570.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several products use Apache Commons FileUpload.

However, data unserialized by the DiskFileItem class are not checked.

An attacker can therefore bypass access restrictions of Apache Commons FileUpload, in order to read or alter files.
Full Vigil@nce bulletin... (Free trial)

security threat CVE-2016-5986

WebSphere AS: information disclosure via Server Identification

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via Server Identification of WebSphere AS, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 16/09/2016.
Identifiers: 1990056, 1990724, 1991900, 1991987, 1995793, 2002049, 2002050, 7014463, CVE-2016-5986, VIGILANCE-VUL-20625.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via Server Identification of WebSphere AS, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer threat CVE-2016-0385

WebSphere AS: information disclosure via HttpSessionIdReuse

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via HttpSessionIdReuse of WebSphere AS, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 17/08/2016.
Identifiers: 1982588, 1989628, 7014463, CVE-2016-0385, VIGILANCE-VUL-20407.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via HttpSessionIdReuse of WebSphere AS, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability note CVE-2016-0377

WebSphere AS: Cross Site Request Forgery

Synthesis of the vulnerability

An attacker can trigger a Cross Site Request Forgery of WebSphere AS, in order to force the victim to perform operations.
Severity: 2/4.
Creation date: 17/08/2016.
Identifiers: 1980645, 1989353, 1989628, 1995384, 7014463, CVE-2016-0377, VIGILANCE-VUL-20406.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The WebSphere AS product offers a web service.

However, the origin of queries is not checked. They can for example originate from an image included in an HTML document.

An attacker can therefore trigger a Cross Site Request Forgery of WebSphere AS, in order to force the victim to perform operations.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about IBM WebSphere Enterprise Service Bus: