IBM WebSphere Application Server 7.0 before Fix Pack 27 appears to be running on the remote host.  It is, therefore, potentially affected by the following vulnerabilities :

  - A request validation error exists related to the proxy     server component that could allow a remote attacker to     cause the proxy status to be reported as disabled, thus     denying applications access to the proxy.
    (CVE-2012-3330, PM71319)

  - A user-supplied input validation error exists that could     allow cross-site request forgery (CSRF) attacks to be     carried out. (CVE-2012-4853, PM62920)

  - Unspecified errors exist related to the administration     console that could allow cross-site scripting attacks.
    (CVE-2013-0458, CVE-2013-0459, CVE-2013-0460, PM71139,     PM72536, PM72275)

  - An unspecified error exists related to the     administration console for 'virtual member manager'     (VMM) that can allow cross-site scripting.
    (CVE-2013-0461, PM71389)

IBM WebSphere Application Server 8.0 before Fix Pack 8 appears to be running on the remote host.  It is, therefore, potentially affected by the following vulnerabilities :

  - A CSRF vulnerability exists in IBM WebSphere Application     Server due to improper validation of portlets in the     Administrative console. (CVE-2013-0460, PM72275)

  - A privilege escalation vulnerability exists on IBM     WebSphere Application Servers using WS-Security that are     configured for XML Digital Signature using trust store.
    (CVE-2013-4053, PM90949, PM91521)

  - An XSS vulnerability exists in IBM WebSphere Application     Server caused by a failure to sanitize user-supplied     input in the UDDI Administrative console.
    (CVE-2013-4052, PM91892)

  - A privilege escalation vulnerability exists in IBM     WebSphere Application Servers that have been migrated     from version 6.1 or later. (CVE-2013-5414, PM92313)

  - An XSS vulnerability exists in IBM WebSphere Application     Server due to a failure to sanitize application HTTP     response data. (CVE-2013-5417, PM93323, PM93944)

  - An XSS vulnerability exists in IBM WebSphere Application     Server due to a failure to sanitize user-supplied input     in the Administrative console. (CVE-2013-5418, PM96477)

  - An XSS vulnerability exists in IBM WebSphere Application     Server due to a failure to sanitize user-supplied input     in the Administrative console. (CVE-2013-6725, PM98132)

  - A denial of service vulnerability exists in IBM     WebSphere Application Server due to a failure to     properly handle requests by a web services endpoint.
    (CVE-2013-6325, PM99450)

  - An information disclosure vulnerability exists in the     IBM SDK for Java that ships with IBM WebSphere     Application Server related to JSSE. (CVE-2013-5780)

  - A denial of service vulnerability exists in the IBM SDK     for Java that ships with IBM WebSphere Application     Server related to XML. (CVE-2013-5372)

  - A denial of service vulnerability exists in the IBM SDK     for Java that ships with IBM WebSphere Application     Server related to JSSE. (CVE-2013-5803)

IBM WebSphere Application Server 8.5 before Fix Pack 8.5.5.1 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities :

  - A flaw exists related to Apache Ant and file     compression that could lead to denial of service     conditions. (CVE-2012-2098 / PM90088)

  - Unspecified errors exist related to the administration     console that could allow cross-site scripting attacks.
    (CVE-2013-0460 / PM72275, CVE-2013-5418 / PM96477,     CVE-2013-5425 / PM93828)

  - Multiple errors exist related to the IBM Eclipse Help     System that could allow cross-site scripting attacks     and information disclosure attacks. (CVE-2013-0464,     CVE-2013-0467, CVE-2013-0599 / PM89893)

  - An input validation flaw exists in the optional     'mod_rewrite' module in the included IBM HTTP Server     that could allow arbitrary command execution via     HTTP requests containing certain escape sequences.
    (CVE-2013-1862 / PM87808)

  - A flaw exists related to the optional 'mod_dav'     module in the included IBM HTTP Server that could     allow denial of service conditions.
    (CVE-2013-1896 / PM89996)

  - A user-supplied input validation error exists that could     allow cross-site request forgery (CSRF) attacks to be     carried out. (CVE-2013-3029 / PM88746)

  - User-supplied input validation errors exist related to     the administrative console that could allow cross-site     scripting attacks.
    (CVE-2013-4004 / PM81571, CVE-2013-4005 / PM88208)

  - An unspecified permissions error exists that could     allow a local attacker to obtain sensitive information.
    Note this issue only affects the 'Liberty Profile'.
    (CVE-2013-4006 / PM90472)

  - An input validation error exists related to the UDDI     Administrative console that could allow cross-site     scripting attacks. (CVE-2013-4052 / PM91892)

  - An attacker may gain elevated privileges because of     improper certificate checks. WS-Security and XML Digital     Signatures must be enabled. (CVE-2013-4053 / PM90949)

  - An error exists related to incorrect Administration     Security roles and migrations from version 6.1.
    (CVE-2013-5414 / PM92313)

  - Unspecified input validation errors exist that could     allow cross-site scripting attacks. (CVE-2013-5417 /     PM93323 and PM93944)

IBM WebSphere Application Server 6.1 before Fix Pack 47 appears to be running on the remote host.  As such, it is potentially affected by the following vulnerabilities :

  - A remote attacker can bypass authentication because of     improper user validation on Linux, Solaris, and HP-UX     platforms that use a LocalOS registry.
    (CVE-2013-0543, PM75582)

  - A denial of service can be caused by the way Apache     Ant uses bzip2 to compress files. This can be exploited     by a local attacker passing specially crafted input.
    (CVE-2012-2098, PM90088)

  - A local attacker can cause a denial of service on     Windows platforms with a LocalOS registry using     WebSphere Identity Manager. (CVE-2013-0541, PM74909)

  - Remote attackers can traverse directories by deploying     a specially crafted application file to overwrite files     outside of the application deployment directory.
    (CVE-2012-3305, PM62467)

  - The TLS protocol implementation is susceptible to     plaintext-recovery attacks via statistical analysis of     timing data for crafted packets. (CVE-2013-0169,     PM85211)

  - Terminal escape sequences are not properly filtered from     logs. Remote attackers could execute arbitrary commands     via an HTTP request containing an escape sequence.
    (CVE-2013-1862, PM87808)

  - Improper validation of user input allows for cross-site     request forgery. By persuading an authenticated user     to visit a malicious website, a remote attacker could     exploit this vulnerability to obtain sensitive     information. (CVE-2012-4853, CVE-2013-3029, PM62920,     PM88746)

  - Improper validation of user input in the administrative     console allows for multiple cross-site scripting     attacks. (CVE-2013-0458, CVE-2013-0459, CVE-2013-0461,     CVE-2013-0542, CVE-2013-0596, CVE-2013-2967,     CVE-2013-4005, CVE-2013-4052, PM71139, PM72536, PM71389,     PM73445, PM78614, PM81846, PM88208, PM91892)

  - Improper validation of portlets in the administrative     console allows for cross-site request forgery, which     could allow an attacker to obtain sensitive information.
    (CVE-2013-0460, PM72275)

  - Remote, authenticated attackers can traverse directories     on Linux and UNIX systems running the application.
    (CVE-2013-0544, PM82468)

  - A denial of service attack is possible if the optional     mod_dav module is being used. (CVE-2013-1896, PM89996)

  - Sensitive information can be obtained by a local     attacker because of incorrect caching by the     administrative console. (CVE-2013-2976, PM79992)

  - An attacker may gain elevated privileges because of     improper certificate checks. WS-Security and XML Digital     Signatures must be enabled. (CVE-2013-4053, PM90949,     PM91521)

  - Deserialization of a maliciously crafted OpenJPA object     can result in an executable file being written to the     file system. WebSphere is NOT vulnerable to this issue     but the vendor suggests upgrading to be proactive.
    (CVE-2013-1768, PM86780, PM86786, PM86788, PM86791)

ID	Name	Product	Family	Published	Updated	Severity
64097	IBM WebSphere Application Server 7.0 < Fix Pack 27 Multiple Vulnerabilities	Nessus	Web Servers	1/25/2013	12/4/2019	medium
72062	IBM WebSphere Application Server 8.0 < Fix Pack 8 Multiple Vulnerabilities	Nessus	Web Servers	1/20/2014	8/6/2018	medium
71229	IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.1 Multiple Vulnerabilities	Nessus	Web Servers	12/5/2013	8/6/2018	medium
70022	IBM WebSphere Application Server 6.1 < Fix Pack 47 Multiple Vulnerabilities	Nessus	Web Servers	9/20/2013	12/5/2022	critical

Detections

Analytics

Plugins Search

medium

medium

medium

critical