ID de Prueba:	1.3.6.1.4.1.25623.1.0.804773
Categoría:	Web application abuses
Título:	JobScheduler Multiple Vulnerabilities (Oct 2014)
Resumen:	JobScheduler is prone to multiple vulnerabilities.
Descripción:	Summary: JobScheduler is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - An incorrectly configured XML parser accepting XML external entities from an untrusted source. - Improper validation of input before returning it to users, specifically path traversal style attacks (e.g. '../'). Vulnerability Impact: Successful exploitation will allow remote attacker to gain access to arbitrary files, execute arbitrary HTML and script code or cause a denial of service. Affected Software/OS: JobScheduler version before 1.6.4246 and 7.x before 1.7.4241. Solution: Upgrade to version 1.6.4246 or 1.7.4241 or later. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-5391 BugTraq ID: 69660 http://www.securityfocus.com/bid/69660 Bugtraq: 20140907 CVE-2014-5391 DOM-based Cross-Site Scripting (XSS) in "JobScheduler" (Google Search) http://www.securityfocus.com/archive/1/533372/100/0/threaded http://packetstormsecurity.com/files/128180/JobScheduler-Cross-Site-Scripting.html http://www.christian-schneider.net/advisories/CVE-2014-5391.txt XForce ISS Database: jobscheduler-cve20145391-xss(95797) https://exchange.xforce.ibmcloud.com/vulnerabilities/95797 Common Vulnerability Exposure (CVE) ID: CVE-2014-5392 Bugtraq: 20140907 CVE-2014-5392 XML eXternal Entity (XXE) in "JobScheduler" (Google Search) http://www.securityfocus.com/archive/1/533374/100/0/threaded http://packetstormsecurity.com/files/128181/JobScheduler-XML-eXternal-Entity-Injection.html http://www.christian-schneider.net/advisories/CVE-2014-5392.txt Common Vulnerability Exposure (CVE) ID: CVE-2014-5393 Bugtraq: 20140907 CVE-2014-5393 Path Traversal to Sensitive Files in Webroot in "JobScheduler" (Google Search) http://www.securityfocus.com/archive/1/533373/100/0/threaded http://packetstormsecurity.com/files/128192/JobScheduler-Path-Traversal.html http://www.christian-schneider.net/advisories/CVE-2014-5393.txt XForce ISS Database: jobscheduler-cve20145393-dir-traversal(95796) https://exchange.xforce.ibmcloud.com/vulnerabilities/95796
Copyright	Copyright (C) 2014 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.