Solaris 10 (x86) : 145346-04 (deprecated)

Oracle Solaris Cluster 3.3: HA-SunONE App Server Patch for Oracle. Date this patch was last updated by Sun : Mar/12/13 This plugin has been deprecated and either replaced with individual 145346 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security,...

CVE-2013-0597

CVE-2013-0597 is an OAuth-related cross-credential vulnerability in IBM WebSphere Application Server. An attacker authenticated to the system could steal other users’ cookie-based credentials. Affected versions: WebSphere Application Server 7.0 before 7.0.0.29; 8.0 before 8.0.0.7; 8.5 before 8.5....

CVE-2013-0542

CVE-2013-0542 (XSS in IBM WebSphere Application Server Admin Console) affects IBM WAS 6.1 (pre-6.1.0.47), 7.0 (pre-7.0.0.29), 8.0 (pre-8.0.0.6), and 8.5 (pre-8.5.0.2). A remote attacker can inject arbitrary script/HTML via crafted input in Admin Console fields, leading to potential user session h...

CVE-2013-1168

CVE-2013-1168 affects Cisco Unified MeetingPlace Application Server. The web server components for 7.x (before 7.1MR1 Patch 2), 8.0 (before 8.0MR1 Patch 1), and 8.5 (before 8.5MR3 Patch 1) fail to invalidate a user session on logout, enabling potential session hijacking through knowledge of a val...

CVE-2012-3304

Summary of the CVEs (IBM WebSphere Application Server family, 2012 vintage): Multiple flaws across WAS versions 6.1, 7.0, 8.0, and 8.5 allow remote or local attackers to hijack sessions (CVE-2012-3304), traverse directories (CVE-2012-3305, PM62467), bypass security restrictions via Federated Repo...

CVE-2012-2190

The provided connected sources confirm CVE-2012-2190 (TLS ClientHello crafted message causing DoS/daemon crash), CVE-2012-2191 (Vaudenay SSL CBC timing issue), and CVE-2012-2203 (PKCS#12 without integrity) involve IBM GSKit in multiple IBM products (WebSphere Application Server/IBM HTTP Server, I...

CVE-2012-2170

CVE-2012-2170 - IBM WebSphere Application Server (7.x) Affects IBM WebSphere Application Server 7.x prior to 7.0.0.23. The vulnerability stems from the Application Snoop Servlet not properly restricting access, enabling remote attackers to obtain sensitive client and request information via a dir...

CVE-2009-2748

IBM WebSphere Application Server Admin Console is affected by CVE-2009-2748: a cross-site scripting (XSS) vulnerability in the Administration Console for WAS 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Acc...

CVE-2011-3559

Unspecified vulnerability in Oracle Communications Server 2.0; GlassFish Enterprise Server 2.1.1, 3.0.1, and 3.1.1; and Sun Java System App Server 8.1 and 8.2 allows remote attackers to affect availability via unknown vectors related to Web Container...

Design/Logic Flaw

Unspecified vulnerability in Oracle Communications Server 2.0; GlassFish Enterprise Server 2.1.1, 3.0.1, and 3.1.1; and Sun Java System App Server 8.1 and 8.2 allows remote attackers to affect availability via unknown vectors related to Web Container...

CVE-2011-3559

CVE-2011-3559 : Open vulnerability affecting Oracle GlassFish Server/Web Container components. Multiple Nessus/OpenVAS entries describe an unspecified DoS vulnerability in GlassFish/Web Container that could affect availability, with affected versions including GlassFish 2.1.1 (up to 2.1.1.14), 3....

CVE-2011-3559

Unspecified vulnerability in Oracle Communications Server 2.0; GlassFish Enterprise Server 2.1.1, 3.0.1, and 3.1.1; and Sun Java System App Server 8.1 and 8.2 allows remote attackers to affect availability via unknown vectors related to Web Container...

CVE-2011-3559: Undefined Security Weakness

Unspecified vulnerability in Oracle Communications Server 2.0; GlassFish Enterprise Server 2.1.1, 3.0.1, and 3.1.1; and Sun Java System App Server 8.1 and 8.2 allows remote attackers to affect availability via unknown vectors related to Web Container...

PT-2011-4533

Name of the Vulnerable Software and Affected Versions Oracle Communications Server version 2.0 GlassFish Enterprise Server versions 2.1.1, 3.0.1, and 3.1.1 Sun Java System App Server versions 8.1 and 8.2 Description The issue affects availability and can be exploited by remote attackers via unkno...

CVE-2011-1355

Open redirect vulnerability in IBM WebSphere Application Server WAS 6.1 before 6.1.0.39 and 7.0 before 7.0.0.19 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage parameter...

CVE-2010-3271

CVE-2010-3271 : IBM WebSphere Application Server (ISC admin console) is vulnerable to multiple CSRF flaws in 7.0.0.13 and earlier. The issues arise where POST requests to adminSecurityDetail.do (Edit) and then to syncworkspace.do (Save) can be forged to hijack an administrator’s session and disab...

Oracle Application Server Authentication Bypass Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle GlassFish Application Server and Oracle Java Application Server. Authentication is not required to exploit this vulnerability. The flaw exists within the Web Administration component which...

CVE-2011-1309

Summary: CVE-2011-1309 affects IBM WebSphere Application Server (WAS) 7.x prior to 7.0.0.15, where the Plug-in component does not properly handle trace requests. The impact is described as unspecified in the sources; no explicit exploitation details are provided. The issue is linked to multiple v...

CVE-2008-7274

CVE-2008-7274 affects IBM WebSphere Application Server 6.1.0.9 when JAAS Login is enabled, allowing an internal hashtable login if a password is omitted or left empty. Impact per sources: authentication bypass with I (partial) integrity impact, network vector, no confidentiality/a‑vailable impact...

CVE-2011-0315

IBM WebSphere Application Server (WAS) is affected by a cross-site scripting (XSS) vulnerability in the Servlet Engine/Web Container component. The issue affects WAS 6.1 prior to 6.1.0.35 and WAS 7.0 prior to 7.0.0.15, enabling remote attackers to inject arbitrary web script or HTML through vecto...