Multiple directory traversal vulnerabilities in the ServiceRegistry UI in IBM WebSphere Service Registry and Repository (WSRR) 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allow remote authenticated users to read arbitrary files via unspecified vectors.

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 8.5 prior to 8.5.0.1. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - An unspecified path traversal vulnerability in the     SERVICEREGISTRY UI. (CVE-2014-6155)

  - A session persistence flaw in which users remain logged     into SERVICEREGISTRYDASHBOARD when using WebSEAL or     Chrome. (CVE-2014-6160)

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 8.0 prior to 8.0.0.3. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - An unspecified path traversal vulnerability in the     SERVICEREGISTRY UI. (CVE-2014-6155)

  - An unspecified script injection vulnerability in WSSR     widgets. (CVE-2014-6178)

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6179)

  - Improper enforcement of object access control     restrictions. (CVE-2014-6186)

  - An unspecified cross-site request forgery (XSRF)     vulnerability. (CVE-2014-6187)

  - Unspecified cross-site scripting (XSS) vulnerabilities.
    (CVE-2014-6188)

The version of IBM WebSphere Service Registry and Repository (WSRR) is version 7.5 prior to 7.5.0.4. It is therefore, affected by multiple vulnerabilities :

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6132)

  - WSSR web interface issues a cookie that is not declared     SSL only. (CVE-2014-6153)

  - An unspecified path traversal vulnerability in the     SERVICEREGISTRY UI. (CVE-2014-6155)

  - An unspecified information disclosure flaw related to     access control checks when a retrieve depth is 0.
    (CVE-2014-6177)

  - An unspecified script injection vulnerability in WSSR     widgets. (CVE-2014-6178)

  - An unspecified DOM based cross-site scripting (XSS)     vulnerability in the WSRR web UI. (CVE-2014-6179)

  - An unspecified HTML injection vulnerability related to     the User-Agent header in the WSRR web UI.
    (CVE-2014-6180)

  - Improper enforcement of object access control     restrictions. (CVE-2014-6186)

  - An unspecified cross-site request forgery (XSRF)     vulnerability. (CVE-2014-6187)

  - Unspecified cross-site scripting (XSS) vulnerabilities.
    (CVE-2014-6188)

ID	Name	Product	Family	Severity
80859	IBM WebSphere Service Registry and Repository 8.5 < 8.5.0.1 Multiple Vulnerabilities	Nessus	Windows	medium
80858	IBM WebSphere Service Registry and Repository 8.0 < 8.0.0.3 Multiple Vulnerabilities	Nessus	Windows	medium
80857	IBM WebSphere Service Registry and Repository 7.5 < 7.5.0.4 Multiple Vulnerabilities	Nessus	Windows	medium

Detections

Analytics

CVE-2014-6155

medium

Tenable Plugins

medium

medium

medium