The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.41, 8.0 prior to 8.0.0.12, or 8.5 prior to 8.5.5.9. It is, therefore, potentially affected by a reflected cross-site scripting (XSS) vulnerability due to a failure to properly validate output from the OAuth provider before returning it to users.
An authenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary script code in a user's browser session within the security context of the hosting website.

リモートホストで実行中の IBM WebSphere Application Server のバージョンは、7.0.0.41 より前の 7.0、8.0.0.12 より前の 8.0、または 8.5.5.9 より前の 8.5 です。このため、OAuth プロバイダーからの出力をユーザーに返す前に適切に検証することに失敗するため、折り返し型クロスサイトスクリプティング（XSS）の脆弱性の影響を受ける可能性があります。
認証されたリモートの攻撃者が、これを悪用して、特別に細工された URL を通じて、ホストしている Web サイトのセキュリティコンテキスト内部のユーザーのブラウザセッションで、任意のスクリプトコードを実行する可能性があります。

遠端主機上執行的 IBM WebSphere Application Server 為比 7.0.0.41 版舊的 7.0 版、比 8.0.0.12 版舊的 8.0 版，或比 8.5.5.9 版舊的 8.5 版。由於未正確驗證來自 OAuth 提供者的輸出便將其傳回給使用者，因此可能受到一個反映式跨網站指令碼 (XSS) 弱點影響。
未經驗證的遠端攻擊者可惡意利用此弱點，透過特製的 URL，在主控網站的安全性內容中，對使用者的瀏覽器工作階段執行任意指令碼。

远程主机上运行的 IBM WebSphere Application Server 是低于 7.0.0.41 的 7.0、低于 8.0.0.12 的 8.0 或低于 8.5.5.9 的 8.5。因此，它可能受到一个反射型跨站脚本 (XSS) 漏洞影响，这是因为未正确验证来自 OAuth 提供者的输出便将其返回给用户所导致。
未经认证的远程攻击者可利用此漏洞，通过特别构建的 URL，在托管网站的安全环境中，对用户的浏览器会话执行任意脚本代码。

The remote host appears to be running IBM WebSphere Application Server 8.0 prior to 8.0.0.12.  Such versions are potentially affected by multiple issues :

 - A flaw exists that is triggered as CRLF (Carriage Return and Line Feed) character sequences are not properly sanitized before being included in HTTP responses.  This allows a remote attacker to inject additional headers into responses to conduct HTTP response splitting attacks.
 - An unspecified flaw exists in the edge component caching proxy that could cause weaker than intended encryption, which may potentially allow an authenticated remote attacker to more easily decrypt information.
 - A flaw exists allowing a reflected cross-site scripting (XSS) vulnerability due to a failure to properly validate output from the OAuth provider before returning it to users.  An authenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary script code in a user's browser session within the security context of the hosting website.
 - A flaw exists that is triggered when handling a connect call that is interrupted.  This may allow a remote attacker to crash the plug-in component and cause a partial denial of service.
 - An overflow condition exists that is triggered as certain input is not properly validated.  This may allow an authenticated remote attacker to cause a buffer overflow, potentially allowing them to bypass security restrictions and disclose sensitive information.

The remote host appears to be running IBM WebSphere Application Server 7.0 prior to 7.0.0.41.  Such versions are potentially affected by multiple issues :

 - A flaw exists allowing a reflected cross-site scripting (XSS) vulnerability due to a failure to properly validate output from the OAuth provider before returning it to users.  An authenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary script code in a user's browser session within the security context of the hosting website. (CVE-2015-7417)
 - A flaw exists in the FIPS140-2 implementation that is related to an improper TLS configuration.  This may allow an attacker with the ability to intercept network traffic (e.g. MitM, DNS cache poisoning) to disclose transmitted data. (CVE-2016-0306)
 - A flaw exists that is due to the program improperly setting the CSRFtoken cookie.  This may allow an authenticated remote attacker to gain access to potentially sensitive information. (CVE-2016-0377)
 - An overflow condition exists that is triggered as certain input is not properly validated.  This may allow an authenticated remote attacker to cause a buffer overflow, potentially allowing them to bypass security restrictions and disclose sensitive information. (CVE-2016-0385)

The remote host appears to be running IBM WebSphere Application Server 8.5 prior to 8.5.5.9.  Such versions are potentially affected by multiple issues :

 - A flaw exists allowing a reflected cross-site scripting (XSS) vulnerability due to a failure to properly validate output from the OAuth provider before returning it to users.  An authenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary script code in a user's browser session within the security context of the hosting website. (CVE-2015-7417)
 - A flaw exists that allows an XSS attack.  This flaw exists because the OpenID Connect (OIDC) client does not validate input before returning it to users.  This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2016-0283)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
90316	IBM WebSphere Application Server 7.0 < 7.0.0.41 / 8.0 < 8.0.0.12 / 8.5 < 8.5.5.9 OAuth Provider XSS	Nessus	Web Servers	2016/4/4	2019/11/20	medium
90316	7.0.0.41 より前の IBM WebSphere Application Server 7.0/8.0.0.12 より前の IBM WebSphere Application Server 8.0/8.5.5.9 より前の IBM WebSphere Application Server 8.5 における OAuth プロバイダーの XSS	Nessus	Web Servers	2016/4/4	2019/11/20	medium
90316	IBM WebSphere Application Server 7.0 < 7.0.0.41 / 8.0 < 8.0.0.12 / 8.5 < 8.5.5.9 OAuth Provider XSS	Nessus	Web Servers	2016/4/4	2019/11/20	medium
90316	IBM WebSphere Application Server 7.0 < 7.0.0.41 / 8.0 < 8.0.0.12 / 8.5 < 8.5.5.9 OAuth Provider XSS	Nessus	Web Servers	2016/4/4	2019/11/20	medium
9714	IBM WebSphere Application Server 8.0 < 8.0.0.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2016/10/26	2019/3/6	low
9701	IBM WebSphere Application Server 7.0 < 7.0.0.41 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2016/10/26	2019/3/6	low
9719	IBM WebSphere Application Server 8.5 < 8.5.5.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2016/10/26	2019/3/6	medium

检测

插件搜索

medium

medium

medium

medium

low

low

medium