| The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them. |
|
 |
|
|
Computer vulnerabilities of WebSphere Application Server Traditional
WebSphere AS: Cross Site Scripting via Admin Console
Synthesis of the vulnerability
An attacker can trigger a Cross Site Scripting via Admin Console of WebSphere AS, in order to run JavaScript code in the context of the web site.
Impacted products: Tivoli Directory Server, Tivoli System Automation, WebSphere AS Traditional, IBM WebSphere ESB.
Severity: 2/4.
Consequences: client access/rights.
Provenance: document.
Creation date: 07/12/2016.
Identifiers: 1992315, 1996037, 1996038, 1996145, 1996238, 7014463, 7036319, CVE-2016-8934, VIGILANCE-VUL-21297.
Description of the vulnerability
The WebSphere AS product offers a web service.
However, it does not filter received data via Admin Console before inserting them in generated HTML documents.
An attacker can therefore trigger a Cross Site Scripting via Admin Console of WebSphere AS, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial) |
WebSphere AS: information disclosure via SOAP
Synthesis of the vulnerability
An attacker can bypass access restrictions to data via SOAP of WebSphere AS, in order to obtain sensitive information.
Impacted products: Security Directory Server, Tivoli System Automation, WebSphere AS Traditional, IBM WebSphere ESB.
Severity: 2/4.
Consequences: data reading.
Provenance: intranet client.
Creation date: 07/12/2016.
Identifiers: 1991469, 1995949, 1996037, 1996038, 1996143, 1996240, CVE-2016-9736, VIGILANCE-VUL-21296.
Description of the vulnerability
An attacker can bypass access restrictions to data via SOAP of WebSphere AS, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial) |
Oracle Java: vulnerabilities of October 2016
Synthesis of the vulnerability
An attacker can use several vulnerabilities of Oracle Java.
Impacted products: Debian, Avamar, Fedora, AIX, Domino, Notes, IRAD, QRadar SIEM, Tivoli Storage Manager, Tivoli System Automation, WebSphere AS Traditional, IBM WebSphere ESB, WebSphere MQ, Junos Space, SnapManager, Java OpenJDK, openSUSE, openSUSE Leap, Java Oracle, JavaFX, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 3/4.
Consequences: user access/rights, data reading, data creation/edition, data deletion, denial of service on service, denial of service on client.
Provenance: document.
Number of vulnerabilities in this bulletin: 7.
Creation date: 19/10/2016.
Identifiers: 1993440, 1994049, 1994123, 1994478, 1997764, 1999054, 1999395, 1999474, 1999478, 1999479, 1999488, 1999532, 2000212, 2000544, 2000904, 2000988, 2000990, 2001608, 2002331, 2002479, 2002537, 2003145, 2004036, 491108, CERTFR-2016-AVI-349, CERTFR-2017-AVI-012, cpuoct2016, CVE-2016-5542, CVE-2016-5554, CVE-2016-5556, CVE-2016-5568, CVE-2016-5573, CVE-2016-5582, CVE-2016-5597, DLA-704-1, DSA-3707-1, ESA-2016-137, FEDORA-2016-73054cfeeb, JSA10770, NTAP-20161019-0001, openSUSE-SU-2016:2862-1, openSUSE-SU-2016:2900-1, openSUSE-SU-2016:2985-1, openSUSE-SU-2016:2990-1, openSUSE-SU-2016:3088-1, RHSA-2016:2079-01, RHSA-2016:2088-01, RHSA-2016:2089-01, RHSA-2016:2090-01, RHSA-2016:2136-01, RHSA-2016:2137-01, RHSA-2016:2138-01, RHSA-2016:2658-01, RHSA-2016:2659-01, RHSA-2017:0061-01, SUSE-SU-2016:2887-1, SUSE-SU-2016:3010-1, SUSE-SU-2016:3040-1, SUSE-SU-2016:3041-1, SUSE-SU-2016:3043-1, SUSE-SU-2016:3068-1, SUSE-SU-2016:3078-1, USN-3121-1, USN-3130-1, USN-3154-1, VIGILANCE-VUL-20906, ZDI-16-571.
Description of the vulnerability
Several vulnerabilities were announced in Oracle Java.
An attacker can use a vulnerability via 2D, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5556]
An attacker can use a vulnerability via AWT, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5568, ZDI-16-571]
An attacker can use a vulnerability via Hotspot, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5582]
An attacker can use a vulnerability via Hotspot, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5573]
An attacker can use a vulnerability via Networking, in order to obtain information. [severity:2/4; CVE-2016-5597]
An attacker can use a vulnerability via JMX, in order to alter information. [severity:2/4; CVE-2016-5554]
An attacker can use a vulnerability via Libraries, in order to alter information. [severity:1/4; CVE-2016-5542]
Full Vigil@nce bulletin... (Free trial) |
Apache Commons FileUpload: read-write access
Synthesis of the vulnerability
An attacker can bypass access restrictions of Apache Commons FileUpload, in order to read or alter files.
Impacted products: Struts, Prime Infrastructure, Secure ACS, Cisco CUCM, Cisco Unified CCX, Unisphere EMC, WebSphere AS Liberty, WebSphere AS Traditional, IBM WebSphere ESB, WebSphere MQ, openSUSE Leap, Oracle Communications, Oracle Fusion Middleware, Oracle Identity Management, Tuxedo, WebLogic, SUSE Linux Enterprise Desktop, SLES, Unix (platform) ~ not comprehensive.
Severity: 3/4.
Consequences: data reading, data creation/edition, data deletion.
Provenance: internet client.
Creation date: 18/10/2016.
Identifiers: 2009844, 2011428, 2011689, 528262, 7018113, 7043863, 7048591, CERTFR-2018-AVI-531, cisco-sa-20181107-struts-commons-fileupload, cpuapr2019, cpujan2019, cpujul2019, CVE-2016-1000031, DSA-2018-210, openSUSE-SU-2019:1399-1, SUSE-SU-2019:1214-1, SUSE-SU-2019:14044-1, TRA-2016-12, VIGILANCE-VUL-20892, ZDI-16-570.
Description of the vulnerability
Several products use Apache Commons FileUpload.
However, data unserialized by the DiskFileItem class are not checked.
An attacker can therefore bypass access restrictions of Apache Commons FileUpload, in order to read or alter files.
Full Vigil@nce bulletin... (Free trial) |
IBM WebSphere Application Server: code execution via serialized objects
Synthesis of the vulnerability
An attacker can use a vulnerability via serial of IBM WebSphere Application Server, in order to run code.
Impacted products: Security Directory Server, Tivoli Directory Server, Tivoli System Automation, Tivoli Workload Scheduler, WebSphere AS Traditional.
Severity: 3/4.
Consequences: administrator access/rights, privileged access/rights, user access/rights.
Provenance: internet client.
Creation date: 23/09/2016.
Identifiers: 1990060, 1991866, 1991867, 1991870, 1991871, 1991875, 1991876, 1991878, 1991880, 1991882, 1991884, 1991885, 1991886, 1991887, 1991889, 1991892, 1991894, 1991896, 1991898, 1991902, 1991903, 1991951, 1991955, 1991959, 1991960, 1991961, 1995390, 1999671, 2000095, 2000544, 2002049, 2002050, 7014463, 7048591, CVE-2016-5983, VIGILANCE-VUL-20686.
Description of the vulnerability
The IBM WebSphere Application Server runs on a Java virtual machine.
It can load serialized objects from external sources. However, it likely does not restrict which classes are loaded when an object is unserialized.
An attacker can therefore send serialized objects to IBM WebSphere Application Server, in order to run code.
Full Vigil@nce bulletin... (Free trial) |
WebSphere AS: information disclosure via Server Identification
Synthesis of the vulnerability
An attacker can bypass access restrictions to data via Server Identification of WebSphere AS, in order to obtain sensitive information.
Impacted products: Security Directory Server, Tivoli Directory Server, Tivoli Storage Manager, Tivoli System Automation, WebSphere AS Traditional, IBM WebSphere ESB.
Severity: 2/4.
Consequences: data reading.
Provenance: intranet client.
Creation date: 16/09/2016.
Identifiers: 1990056, 1990724, 1991900, 1991987, 1995793, 2002049, 2002050, 7014463, CVE-2016-5986, VIGILANCE-VUL-20625.
Description of the vulnerability
An attacker can bypass access restrictions to data via Server Identification of WebSphere AS, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial) |
WebSphere AS: information disclosure via HttpSessionIdReuse
Synthesis of the vulnerability
An attacker can bypass access restrictions to data via HttpSessionIdReuse of WebSphere AS, in order to obtain sensitive information.
Impacted products: WebSphere AS Traditional, IBM WebSphere ESB.
Severity: 2/4.
Consequences: data reading.
Provenance: intranet client.
Creation date: 17/08/2016.
Identifiers: 1982588, 1989628, 7014463, CVE-2016-0385, VIGILANCE-VUL-20407.
Description of the vulnerability
An attacker can bypass access restrictions to data via HttpSessionIdReuse of WebSphere AS, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial) |
WebSphere AS: Cross Site Request Forgery
Synthesis of the vulnerability
An attacker can trigger a Cross Site Request Forgery of WebSphere AS, in order to force the victim to perform operations.
Impacted products: Tivoli System Automation, Tivoli Workload Scheduler, WebSphere AS Traditional, IBM WebSphere ESB.
Severity: 2/4.
Consequences: user access/rights.
Provenance: internet client.
Creation date: 17/08/2016.
Identifiers: 1980645, 1989353, 1989628, 1995384, 7014463, CVE-2016-0377, VIGILANCE-VUL-20406.
Description of the vulnerability
The WebSphere AS product offers a web service.
However, the origin of queries is not checked. They can for example originate from an image included in an HTML document.
An attacker can therefore trigger a Cross Site Request Forgery of WebSphere AS, in order to force the victim to perform operations.
Full Vigil@nce bulletin... (Free trial) |
WebSphere AS: denial of service via SIP
Synthesis of the vulnerability
An attacker can send a malicious SIP packet to IBM WebSphere AS, in order to trigger a denial of service.
Impacted products: Tivoli System Automation, WebSphere AS Traditional, IBM WebSphere ESB.
Severity: 2/4.
Consequences: denial of service on server, denial of service on service.
Provenance: intranet client.
Creation date: 02/08/2016.
Identifiers: 1984796, 1989351, 1989628, 7014463, CVE-2016-2960, VIGILANCE-VUL-20285.
Description of the vulnerability
The IBM WebSphere AS product has a service to manage received SIP packets.
However, when a malicious packet is received, a fatal error occurs.
An attacker can therefore send a malicious SIP packet to IBM WebSphere AS, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial) |
Oracle Java: vulnerabilities of July 2016
Synthesis of the vulnerability
An attacker can use several vulnerabilities of Oracle Java.
Impacted products: Debian, VNX Operating Environment, VNX Series, BIG-IP Hardware, TMOS, Fedora, AIX, Domino, Notes, IRAD, SPSS Statistics, Tivoli Storage Manager, Tivoli System Automation, WebSphere AS Traditional, IBM WebSphere ESB, WebSphere MQ, JAXP, ePO, Java OpenJDK, openSUSE, openSUSE Leap, Java Oracle, JavaFX, RHEL, SUSE Linux Enterprise Desktop, SLES, Ubuntu.
Severity: 3/4.
Consequences: privileged access/rights, user access/rights, data reading, data creation/edition, data deletion, denial of service on service, denial of service on client.
Provenance: user account.
Number of vulnerabilities in this bulletin: 13.
Creation date: 20/07/2016.
Identifiers: 1988339, 1988894, 1988978, 1989049, 1989337, 1990031, 1990448, 1991383, 1991909, 1991910, 1991911, 1991913, 1991997, 1995792, 1995799, 2001630, 2007242, 486953, CERTFR-2016-AVI-243, cpujul2016, CVE-2016-3458, CVE-2016-3485, CVE-2016-3498, CVE-2016-3500, CVE-2016-3503, CVE-2016-3508, CVE-2016-3511, CVE-2016-3550, CVE-2016-3552, CVE-2016-3587, CVE-2016-3598, CVE-2016-3606, CVE-2016-3610, DLA-579-1, DSA-3641-1, ESA-2016-099, FEDORA-2016-588e386aaa, FEDORA-2016-c07d18b2a5, FEDORA-2016-c60d35c46c, openSUSE-SU-2016:2050-1, openSUSE-SU-2016:2051-1, openSUSE-SU-2016:2052-1, openSUSE-SU-2016:2058-1, RHSA-2016:1458-01, RHSA-2016:1475-01, RHSA-2016:1476-01, RHSA-2016:1477-01, RHSA-2016:1504-01, RHSA-2016:1587-01, RHSA-2016:1588-01, RHSA-2016:1589-01, RHSA-2016:1776-01, SB10166, SOL05016441, SOL25075696, SUSE-SU-2016:1997-1, SUSE-SU-2016:2012-1, SUSE-SU-2016:2261-1, SUSE-SU-2016:2286-1, SUSE-SU-2016:2347-1, SUSE-SU-2016:2348-1, SUSE-SU-2016:2726-1, USN-3043-1, USN-3062-1, USN-3077-1, VIGILANCE-VUL-20169, ZDI-16-445, ZDI-16-446, ZDI-16-447, ZDI-16-448.
Description of the vulnerability
Several vulnerabilities were announced in Oracle Communications.
An attacker can use a vulnerability via Hotspot, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-3587, ZDI-16-448]
An attacker can use a vulnerability via Hotspot, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-3606, ZDI-16-447]
An attacker can use a vulnerability via Libraries, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-3598, ZDI-16-446]
An attacker can use a vulnerability via Libraries, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-3610, ZDI-16-445]
An attacker can use a vulnerability via Install, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-3552]
An attacker can use a vulnerability via Deployment, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-3511]
An attacker can use a vulnerability via Install, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-3503]
An attacker can use a vulnerability via JavaFX, in order to trigger a denial of service. [severity:2/4; CVE-2016-3498]
An attacker can use a vulnerability via JAXP, in order to trigger a denial of service. [severity:2/4; CVE-2016-3500]
An attacker can use a vulnerability via JAXP, in order to trigger a denial of service. [severity:2/4; CVE-2016-3508]
An attacker can use a vulnerability via CORBA, in order to alter information. [severity:2/4; CVE-2016-3458]
An attacker can use a vulnerability via Hotspot, in order to alter information, or to trigger a denial of service. [severity:2/4; CVE-2016-3550]
An attacker can use a vulnerability via Networking, in order to alter information. [severity:1/4; CVE-2016-3485]
Full Vigil@nce bulletin... (Free trial) |
Our database contains other pages. You can request a free trial to read them.
Display information about WebSphere Application Server Traditional:
|