Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

IBM WebSphere Application Server 6.1 before Fix Pack 37 appears to be running on the remote host.  As such, it is potentially affected by the following vulnerabilities :

  - It is possible to trigger a DoS condition via SAAJ     API provided by the WebSphere Web services runtime.
    (PM19534)

  - An unspecified cross-site scripting vulnerability     exists in the IVT application. (PM20393)

  - The AuthCache purge implementation is not able to     purge a user in AuthCache. (PM24668)

  - A remote attacker can gain unspecified application access     on z/OS, when a Local OS user registry or Federated     Repository with RACF adapter is used. (PM35478)

IBM WebSphere Application Server 7.0 before Fix Pack 15 appears to be running on the remote host.  As such, it is reportedly affected by the following vulnerabilities :

  - A double free error in BBOOORBR control block could     trigger a denial of service condition. (PM17170)

  - A cross-site scripting vulnerability exists in the     web container. (PM18512)

  - It is possible for authenticated users to trigger a DoS     condition by using Lightweight Third-Party     Authentication (LTPA) tokens for authentication.
    (PM18644)

  - Sensitive wsadmin command parameters are included in     trace files, which could result in an information     disclosure vulnerability. (PM18736)

  - A memory leak in    'com.ibm.ws.jsp.runtime.WASJSPStrBufferImpl' could     trigger a DoS condition. (PM19500)

  - It is possible to trigger a DoS condition via SAAJ     API provided by the WebSphere Web services runtime.
    (PM19534)

  - The Service Integration Bus (SIB) messaging engine is     affected by a DoS issue. (PM19834)

  - The installer creates a temporary log file directory     with open '777' permissions. (PM20021)

  - A cross-site scripting vulnerability exists in the     IVT application.(PM20393)

  - User credentials are not cleared from the cache, even     after an user has logged out. (PM21536)

  - Trace requests are not handled correctly, which could     result in an unspecified issue. (PM22860)

  - A memory leak in     'org.apache.jasper.runtime.JspWriterImpl.response' could     trigger a denial of service condition. (PM23029)

  - Under certain conditions, SIP proxy may stop processing     UDP messages, resulting in a DoS condition. (PM23115)

  - Memory leak in the messaging engine could trigger a     denial of service condition. (PM23626)

  - Improper access is allowed to certain control servlets.
    (PM24372)

  - The AuthCache purge implementation is not able to     purge a user in AuthCache. (PM24668)

  - Incorrect security role mapping could occur while     using J2EE 1.4 application. (PM25455)

  - It is possible for Administrator role members to modify     primary administrative id via the administrative     console. (PK88606)

ID	Name	Product	Family	Type	Severity
53475	IBM WebSphere Application Server 6.1 < 6.1.0.37 Multiple Vulnerabilities	Nessus	Web Servers	Remote	medium
52615	IBM WebSphere Application Server 7.0 < Fix Pack 15 Multiple Vulnerabilities	Nessus	Web Servers	Remote	high

Detections

Analytics

CVE-2011-1308

medium

Tenable Plugins

medium

high