Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

IBM WebSphere Application Server 6.1 before Fix Pack 35 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - An unspecified cross-site scripting vulnerability     exists in the Administration Console. (PM14251)

  - A double free error in BBOOORBR control block could     trigger a denial of service condition. (PM17170)

  - An unspecified cross-site scripting vulnerability     exists in the web container. (PM18512)

  - It is possible for authenticated users to trigger a DoS     condition by using Lightweight Third-Party     Authentication (LTPA) tokens for authentication.
    (PM18644)

  - Sensitive wsadmin command parameters are included in     trace files, which could result in an information     disclosure vulnerability. (PM18736)

  - An unspecified cross-site request forgery vulnerability     exists in the Administration Console. (PM18909)

  - User credentials are not cleared from the cache, even     after a user has logged out. (PM21536)

  - An unspecified vulnerability could allow improper     access to console servlets. (PM24372)

IBM WebSphere Application Server 7.0 before Fix Pack 13 appears to be running on the remote host.  As such, it is reportedly affected by the following vulnerabilities :

  - A cross-site scripting vulnerability exists in the     administrative console due to improper filtering on     input values. (PM14251)

  - A cross-site scripting vulnerability exists in the     Integrated Solution Console due to improper filtering on     input values. (PM11777)

  - An unspecified cross-site request forgery vulnerability     exists in the administrative console for WebSphere     Application Server. (PM18909)

  - An unspecified cross-site scripting vulnerability     exists in the administrative console for WebSphere     Application Server for z/OS. (PM17046)

  - An error exists in JAX-WS WS-Security, which mishandles     timestamps in the WS-SecurityPolicy specification.
    (PM16014)

  - An error exists in the JAX-WS API, which allows an     attacker to cause a denial of service by sending a     specially crafted JAX-WS request. The server will begin     sending corrupt data to its clients. (PM13777)

  - Apache Axis2/Java, used by WebSphere, is vulnerable to     denial of service and information disclosure attacks due     to an error in its XML DTD handling processes. (PM14844)

  - An unspecified error exists in the administration     console that can cause high CPU usage and denial of     service when specially crafted URLs are requested.
    (PM11807)

ID	Name	Product	Family	Type	Severity
51510	IBM WebSphere Application Server 6.1 < 6.1.0.35 Multiple Vulnerabilities	Nessus	Web Servers	Remote	medium
50561	IBM WebSphere Application Server 7.0 < Fix Pack 13 Multiple Vulnerabilities	Nessus	Web Servers	Remote	high

Detections

Analytics

CVE-2010-0783

medium

Tenable Plugins

medium

high