JVN Info.

Id
7492  
Name
JVNDB-2015-002812  
Title
SAP NetWeaver AS Java における XML 外部エンティティの脆弱性  
Summary
SAP NetWeaver AS Java には、"CIM UPLOAD" に関する処理に不備があるため、XML 外部エンティティ (XXE) の脆弱性が存在します。  
Nvdinfo
CVE-2015-4091  
Cvssv2
7.5  
Jvnurl
http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002812.html  
Published Date
2015-05-18  
Registered Date
2015-05-28  
Last Updated Date
2015-05-28  

Actions

Related Nessuslogs

Id Log ID Jvninfo Id Plugin ID CVE CVSS Risk Host Protocol Port Name Synopsis Description Solution See Also Plugin Output Actions
51594 H28_MUN_DWEB_Q4_172_16_240_seg.csv 7492 89677 CVE-2011-0426 5 Medium 172.16.240.115 tcp 443 VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2011-0008) (remote check) The remote VMware ESX / ESXi host is missing a security-related patch. The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities : - A directory traversal vulnerability exists that allows a remote attacker to read arbitrary files. (CVE-2011-0426) - An information disclosure vulnerability exists due to insecure storage of SOAP sesion IDs in a log file. A local attacker can exploit this to disclose administrative user IDs. (CVE-2011-1788) - A digital signature verification weakness exists in the self-extracting installer in the vSphere Client Installer package. A remote attacker can exploit this to spoof the software distribution via a Trojan horse installer. (CVE-2011-1789) Apply the appropriate patch according to the vendor advisory that pertains to ESX version 4.0 or ESXi version 4.0. https://www.vmware.com/security/advisories/VMSA-2011-0008 http://lists.vmware.com/pipermail/security-announce/2011/000137.html Version : ESX 4.0 Installed build : 208167 Fixed build : 360236
57175 H28_DWEB_NW_Scan_Q1_172_16_240_Seg_20160518_hepxqa.csv 7492 89677 CVE-2011-0426 5 Medium 172.16.240.115 tcp 443 VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2011-0008) (remote check) The remote VMware ESX / ESXi host is missing a security-related patch. The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities : - A directory traversal vulnerability exists that allows a remote attacker to read arbitrary files. (CVE-2011-0426) - An information disclosure vulnerability exists due to insecure storage of SOAP sesion IDs in a log file. A local attacker can exploit this to disclose administrative user IDs. (CVE-2011-1788) - A digital signature verification weakness exists in the self-extracting installer in the vSphere Client Installer package. A remote attacker can exploit this to spoof the software distribution via a Trojan horse installer. (CVE-2011-1789) Apply the appropriate patch according to the vendor advisory that pertains to ESX version 4.0 or ESXi version 4.0. https://www.vmware.com/security/advisories/VMSA-2011-0008 http://lists.vmware.com/pipermail/security-announce/2011/000137.html Version : ESX 4.0 Installed build : 208167 Fixed build : 360236