This host is running Oracle iPlanet Web Server and is prone to multiple cross site scripting vulnerabilities.

Successful exploitation will allow remote attackers to insert arbitrary HTML and script code, which will be executed in a user's browser session in the context of an affected site. Impact Level: Application

Please refer below link for updates, http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixSUNS

- Input passed via the 'helpLogoWidth' and 'helpLogoHeight' parameters to admingui/cchelp2/Masthead.jsp (when 'mastheadTitle' is set) and the 'productNameSrc', 'productNameHeight', and 'productNameWidth' parameters to admingui/version/Masthead.jsp is not properly sanitised before being returned to the user. - Input passed via the 'appName' and 'pathPrefix' parameters to admingui/ cchelp2/Navigator.jsp is not properly sanitised before being returned to the user.

Oracle iPlanet WebServer 7.0

• http://chingshiong.blogspot.in/2012/04/oracle-iplanet-web-server-709-multiple.html
• http://osvdb.org/81440
• http://secunia.com/advisories/43942
• http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html
• http://www.securityfocus.com/bid/53133

---

Updated on 2015-03-25