Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1)
    <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote
    attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors. (CVE-2013-5855)

update to 2.2.13. fix CVE-2013-5855 rhbz#1087182,1065139

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of GlassFish Server running on the remote host is affected by multiple vulnerabilities in the following components :

  - The implementation of Network Security Services (NSS)     does not ensure that data structures are initialized,     which could result in a denial of service or disclosure     of sensitive information. (CVE-2013-1739)

  - The implementation of Network Security Services (NSS)     does not properly handle the TLS False Start feature     and could allow man-in-the-middle attacks.
    (CVE-2013-1740)

  - Network Security Services (NSS) contains an integer     overflow flaw that allows remote attackers to cause a     denial of service. (CVE-2013-1741)

  - An error exists in the 'Null_Cipher' function in the     file 'ssl/ssl3con.c' related to handling invalid     handshake packets that could allow arbitrary code     execution. (CVE-2013-5605)

  - An error exists in the 'CERT_VerifyCert' function in     the file 'lib/certhigh/certvfy.c' that could allow     invalid certificates to be treated as valid.
    (CVE-2013-5606)

  - Oracle Mojarra contains a cross-site scripting     vulnerability due to improperly sanitized     user-supplied input. This allows an attacker to     execute arbitrary script code within the context of     the affected site. (CVE-2013-5855)

  - Network Security Services (NSS) contains a race     condition in libssl that occurs during session ticket     processing. A remote attacker can exploit this flaw     to cause a denial of service. (CVE-2014-1490)

  - Network Security Services (NSS) does not properly     restrict public values in Diffie-Hellman key exchanges,     allowing a remote attacker to bypass cryptographic     protection mechanisms. (CVE-2014-1491)

  - An issue exists in the Network Security (NSS) library     due to improper handling of IDNA domain prefixes for     wildcard certificates. This issue allows man-in-     the-middle attacks. (CVE-2014-1492)

The remote host has a version of Oracle WebLogic Server installed that is affected by multiple vulnerabilities affecting multiple components.

ID	Name	Product	Family	Severity
409586	SCA: security update for org.glassfish:javax.faces (GHSA-3m3r-82gc-53mj)	Tenable Cloud Security	SCA Checks	medium
409586	SCA: security update for org.glassfish:javax.faces (GHSA-3m3r-82gc-53mj)	Tenable Self-Hosted Container Security	SCA Checks	medium
94867	Fedora 25 : mojarra (2016-d6c87eb4af)	Nessus	Fedora Local Security Checks	medium
76591	Oracle GlassFish Server Multiple Vulnerabilities (July 2014 CPU)	Nessus	Web Servers	high
76527	Oracle WebLogic Server Multiple Vulnerabilities (July 2014 CPU)	Nessus	Misc.	high

Detections

Analytics

CVE-2013-5855

medium

Tenable Plugins

medium

medium

medium

high

high