| The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them. |
|
 |
|
|
Computer vulnerabilities of WebSphere Application Server Traditional
WebSphere AS: Cross Site Scripting via Admin Console
Synthesis of the vulnerability
An attacker can trigger a Cross Site Scripting of WebSphere AS, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Creation date: 10/02/2017.
Identifiers: 1997743, 1999058, 1999634, 2000813, 2009072, 2009082, 2009087, 2009089, 2009090, 7014463, 7036319, CVE-2017-1121, VIGILANCE-VUL-21796.
Full Vigil@nce bulletin... (Free trial)
Description of the vulnerability
The WebSphere AS product offers a web service.
However, it does not filter received data before inserting them in generated HTML documents.
An attacker can therefore trigger a Cross Site Scripting of WebSphere AS, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial) |
OpenSSL: multiple vulnerabilities
Synthesis of the vulnerability
An attacker can use several vulnerabilities of OpenSSL.
Severity: 2/4.
Number of vulnerabilities in this bulletin: 4.
Creation date: 26/01/2017.
Identifiers: 1117414, 2000544, 2000988, 2000990, 2002331, 2004036, 2004940, 2009389, 2010154, 2011567, 2012827, 2014202, 2014651, 2014669, 2015080, BSA-2016-204, BSA-2016-207, BSA-2016-211, BSA-2016-212, BSA-2016-213, BSA-2016-216, BSA-2016-234, bulletinapr2017, bulletinjan2018, bulletinoct2017, CERTFR-2017-AVI-035, CERTFR-2018-AVI-343, cisco-sa-20170130-openssl, cpuapr2017, cpuapr2019, cpujan2018, cpujul2017, cpujul2018, cpuoct2017, CVE-2016-7055, CVE-2017-3730, CVE-2017-3731, CVE-2017-3732, DLA-814-1, DSA-3773-1, FEDORA-2017-3451dbec48, FEDORA-2017-e853b4144f, FG-IR-17-019, FreeBSD-SA-17:02.openssl, ibm10732391, ibm10733905, ibm10738249, ibm10738401, JSA10775, K37526132, K43570545, K44512851, K-510805, NTAP-20170127-0001, NTAP-20170310-0002, NTAP-20180201-0001, openSUSE-SU-2017:0481-1, openSUSE-SU-2017:0487-1, openSUSE-SU-2017:0527-1, openSUSE-SU-2017:0941-1, openSUSE-SU-2017:2011-1, openSUSE-SU-2017:2868-1, openSUSE-SU-2018:0458-1, PAN-70674, PAN-73914, PAN-SA-2017-0012, PAN-SA-2017-0014, PAN-SA-2017-0016, RHSA-2017:0286-01, RHSA-2018:2568-01, RHSA-2018:2575-01, SA141, SA40423, SB10188, SSA:2017-041-02, SUSE-SU-2018:0112-1, SUSE-SU-2018:2839-1, SUSE-SU-2018:3082-1, TNS-2017-03, USN-3181-1, VIGILANCE-VUL-21692.
Full Vigil@nce bulletin... (Free trial)
Description of the vulnerability
Several vulnerabilities were announced in OpenSSL.
An attacker can force a read at an invalid address via Truncated Packet, in order to trigger a denial of service, or to obtain sensitive information. [severity:2/4; CVE-2017-3731]
An attacker can force a NULL pointer to be dereferenced via DHE/ECDHE Parameters, in order to trigger a denial of service. [severity:2/4; CVE-2017-3730]
An attacker can use a carry propagation error via BN_mod_exp(), in order to compute the private key. [severity:1/4; CVE-2017-3732]
An error occurs in the Broadwell-specific Montgomery Multiplication Procedure, but with no apparent impact. [severity:1/4; CVE-2016-7055]
Full Vigil@nce bulletin... (Free trial) |
Oracle Java: vulnerabilities of January 2017
Synthesis of the vulnerability
An attacker can use several vulnerabilities of Oracle Java.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 17.
Creation date: 18/01/2017.
Identifiers: 1998379, 1998858, 1999054, 1999999, 2000212, 2000304, 2000516, 2000544, 2000602, 2000988, 2000990, 2001608, 2002331, 2002335, 2002336, 2002479, 2002537, 2002966, 2002991, 2003145, 2004036, 2004938, 2007242, bulletinapr2017, CERTFR-2017-AVI-017, cpujan2017, CVE-2016-2183, CVE-2016-5546, CVE-2016-5547, CVE-2016-5548, CVE-2016-5549, CVE-2016-5552, CVE-2016-8328, CVE-2017-3231, CVE-2017-3241, CVE-2017-3252, CVE-2017-3253, CVE-2017-3259, CVE-2017-3260, CVE-2017-3261, CVE-2017-3262, CVE-2017-3272, CVE-2017-3289, DLA-802-1, DLA-821-1, DSA-2019-131, DSA-3782-1, ERPSCAN-17-006, ESA-2017-051, FEDORA-2017-4cb58f0bda, FEDORA-2017-c1252ccd41, ibm10718843, java_jan2017_advisory, NTAP-20170119-0001, openSUSE-SU-2017:0374-1, openSUSE-SU-2017:0513-1, RHSA-2017:0175-01, RHSA-2017:0176-01, RHSA-2017:0177-01, RHSA-2017:0180-01, RHSA-2017:0263-01, RHSA-2017:0269-01, RHSA-2017:0336-01, RHSA-2017:0337-01, RHSA-2017:0338-01, RHSA-2017:0462-01, SB10186, SUSE-SU-2017:0346-1, SUSE-SU-2017:0460-1, SUSE-SU-2017:0490-1, SUSE-SU-2017:1444-1, USN-3179-1, USN-3194-1, USN-3198-1, VIGILANCE-VUL-21606, ZDI-17-056, ZDI-17-057.
Full Vigil@nce bulletin... (Free trial)
Description of the vulnerability
Several vulnerabilities were announced in Oracle Java.
An attacker can use a vulnerability via Hotspot, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2017-3289, ZDI-17-057]
An attacker can use a vulnerability via Libraries, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2017-3272, ZDI-17-056]
An attacker can use a vulnerability via RMI, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2017-3241]
An attacker can use a vulnerability via AWT, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2017-3260]
An attacker can use a vulnerability via 2D, in order to trigger a denial of service. [severity:3/4; CVE-2017-3253]
An attacker can use a vulnerability via Libraries, in order to alter information. [severity:3/4; CVE-2016-5546]
An attacker can use a vulnerability via Libraries, in order to obtain information. [severity:2/4; CVE-2016-5549]
An attacker can use a vulnerability via Libraries, in order to obtain information. [severity:2/4; CVE-2016-5548]
An attacker can use a vulnerability via JAAS, in order to alter information. [severity:2/4; CVE-2017-3252]
An attacker can use a vulnerability via Java Mission Control, in order to obtain information. [severity:2/4; CVE-2017-3262]
An attacker can use a vulnerability via Libraries, in order to trigger a denial of service. [severity:2/4; CVE-2016-5547]
An attacker can use a vulnerability via Networking, in order to alter information. [severity:2/4; CVE-2016-5552]
An attacker can use a vulnerability via Networking, in order to obtain information. [severity:2/4; CVE-2017-3231]
An attacker can use a vulnerability via Networking, in order to obtain information. [severity:2/4; CVE-2017-3261]
An attacker can use a vulnerability via Deployment, in order to obtain information. [severity:1/4; CVE-2017-3259]
An attacker can use a vulnerability via Java Mission Control, in order to alter information. [severity:1/4; CVE-2016-8328]
An attacker can use a vulnerability via Libraries, in order to obtain information. [severity:1/4; CVE-2016-2183]
Full Vigil@nce bulletin... (Free trial) |
IBM WebSphere AS: denial of service via a SOAP interface
Synthesis of the vulnerability
An attacker can generate an huge usage of resources via a SOAP interface of IBM WebSphere AS, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 18/01/2017.
Identifiers: 1993797, 1997765, 1997912, 1998432, 7014463, 7036319, CVE-2016-8919, VIGILANCE-VUL-21605.
Full Vigil@nce bulletin... (Free trial)
Description of the vulnerability
An attacker can generate an huge usage of resources via a SOAP interface of IBM WebSphere AS, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial) |
IBM WebSphere MQ: code execution via JMSObjectMessage
Synthesis of the vulnerability
An attacker can send packed objects be decoded by JMSObjectMessage of IBM WebSphere MQ, in order to run arbitrary code.
Severity: 3/4.
Creation date: 06/01/2017.
Identifiers: 1983457, 1996748, 2000729, 2000730, 2001510, CVE-2016-0360, VIGILANCE-VUL-21526.
Full Vigil@nce bulletin... (Free trial)
Description of the vulnerability
The IBM WebSphere MQ product handles serialized objects via its class JMSObjectMessage.
However, this class does not rightly check the origin of objects and associated classes.
An attacker can therefore send packed objects be decoded by JMSObjectMessage of IBM WebSphere MQ, in order to run arbitrary code.
Full Vigil@nce bulletin... (Free trial) |
WebSphere AS: Cross Site Scripting via Admin Console
Synthesis of the vulnerability
An attacker can trigger a Cross Site Scripting via Admin Console of WebSphere AS, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Creation date: 07/12/2016.
Identifiers: 1992315, 1996037, 1996038, 1996145, 1996238, 7014463, 7036319, CVE-2016-8934, VIGILANCE-VUL-21297.
Full Vigil@nce bulletin... (Free trial)
Description of the vulnerability
The WebSphere AS product offers a web service.
However, it does not filter received data via Admin Console before inserting them in generated HTML documents.
An attacker can therefore trigger a Cross Site Scripting via Admin Console of WebSphere AS, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial) |
WebSphere AS: information disclosure via SOAP
Synthesis of the vulnerability
An attacker can bypass access restrictions to data via SOAP of WebSphere AS, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 07/12/2016.
Identifiers: 1991469, 1995949, 1996037, 1996038, 1996143, 1996240, CVE-2016-9736, VIGILANCE-VUL-21296.
Full Vigil@nce bulletin... (Free trial)
Description of the vulnerability
An attacker can bypass access restrictions to data via SOAP of WebSphere AS, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial) |
Oracle Java: vulnerabilities of October 2016
Synthesis of the vulnerability
An attacker can use several vulnerabilities of Oracle Java.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 7.
Creation date: 19/10/2016.
Identifiers: 1993440, 1994049, 1994123, 1994478, 1997764, 1999054, 1999395, 1999474, 1999478, 1999479, 1999488, 1999532, 2000212, 2000544, 2000904, 2000988, 2000990, 2001608, 2002331, 2002479, 2002537, 2003145, 2004036, 491108, CERTFR-2016-AVI-349, CERTFR-2017-AVI-012, cpuoct2016, CVE-2016-5542, CVE-2016-5554, CVE-2016-5556, CVE-2016-5568, CVE-2016-5573, CVE-2016-5582, CVE-2016-5597, DLA-704-1, DSA-3707-1, ESA-2016-137, FEDORA-2016-73054cfeeb, JSA10770, NTAP-20161019-0001, openSUSE-SU-2016:2862-1, openSUSE-SU-2016:2900-1, openSUSE-SU-2016:2985-1, openSUSE-SU-2016:2990-1, openSUSE-SU-2016:3088-1, RHSA-2016:2079-01, RHSA-2016:2088-01, RHSA-2016:2089-01, RHSA-2016:2090-01, RHSA-2016:2136-01, RHSA-2016:2137-01, RHSA-2016:2138-01, RHSA-2016:2658-01, RHSA-2016:2659-01, RHSA-2017:0061-01, SUSE-SU-2016:2887-1, SUSE-SU-2016:3010-1, SUSE-SU-2016:3040-1, SUSE-SU-2016:3041-1, SUSE-SU-2016:3043-1, SUSE-SU-2016:3068-1, SUSE-SU-2016:3078-1, USN-3121-1, USN-3130-1, USN-3154-1, VIGILANCE-VUL-20906, ZDI-16-571.
Full Vigil@nce bulletin... (Free trial)
Description of the vulnerability
Several vulnerabilities were announced in Oracle Java.
An attacker can use a vulnerability via 2D, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5556]
An attacker can use a vulnerability via AWT, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5568, ZDI-16-571]
An attacker can use a vulnerability via Hotspot, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5582]
An attacker can use a vulnerability via Hotspot, in order to obtain information, to alter information, or to trigger a denial of service. [severity:3/4; CVE-2016-5573]
An attacker can use a vulnerability via Networking, in order to obtain information. [severity:2/4; CVE-2016-5597]
An attacker can use a vulnerability via JMX, in order to alter information. [severity:2/4; CVE-2016-5554]
An attacker can use a vulnerability via Libraries, in order to alter information. [severity:1/4; CVE-2016-5542]
Full Vigil@nce bulletin... (Free trial) |
Apache Commons FileUpload: read-write access
Synthesis of the vulnerability
An attacker can bypass access restrictions of Apache Commons FileUpload, in order to read or alter files.
Severity: 3/4.
Creation date: 18/10/2016.
Identifiers: 2009844, 2011428, 2011689, 528262, 7018113, 7043863, 7048591, CERTFR-2018-AVI-531, cisco-sa-20181107-struts-commons-fileupload, cpuapr2019, cpujan2019, cpujul2019, cpuoct2019, CVE-2016-1000031, DSA-2018-210, openSUSE-SU-2019:1399-1, SUSE-SU-2019:1212-2, SUSE-SU-2019:1214-1, SUSE-SU-2019:14044-1, TRA-2016-12, VIGILANCE-VUL-20892, ZDI-16-570.
Full Vigil@nce bulletin... (Free trial)
Description of the vulnerability
Several products use Apache Commons FileUpload.
However, data unserialized by the DiskFileItem class are not checked.
An attacker can therefore bypass access restrictions of Apache Commons FileUpload, in order to read or alter files.
Full Vigil@nce bulletin... (Free trial) |
IBM WebSphere Application Server: code execution via serialized objects
Synthesis of the vulnerability
An attacker can use a vulnerability via serial of IBM WebSphere Application Server, in order to run code.
Severity: 3/4.
Creation date: 23/09/2016.
Identifiers: 1990060, 1991866, 1991867, 1991870, 1991871, 1991875, 1991876, 1991878, 1991880, 1991882, 1991884, 1991885, 1991886, 1991887, 1991889, 1991892, 1991894, 1991896, 1991898, 1991902, 1991903, 1991951, 1991955, 1991959, 1991960, 1991961, 1995390, 1999671, 2000095, 2000544, 2002049, 2002050, 7014463, 7048591, CVE-2016-5983, VIGILANCE-VUL-20686.
Full Vigil@nce bulletin... (Free trial)
Description of the vulnerability
The IBM WebSphere Application Server runs on a Java virtual machine.
It can load serialized objects from external sources. However, it likely does not restrict which classes are loaded when an object is unserialized.
An attacker can therefore send serialized objects to IBM WebSphere Application Server, in order to run code.
Full Vigil@nce bulletin... (Free trial) |
Our database contains other pages. You can request a free trial to read them.
Display information about WebSphere Application Server Traditional:
|