(PVS) Signatures - Tenable Network Security

vulnerabilities : \n\n - The administrative component's secure login page fails to redirect to
an 'https: //' page when it receives an 'http: //' request. (PK77010)\n\n - An unspecified
security issue affects 'wsadmin' in the 'SystemManagement/Repository' component.
(PK77235)\n\n - An information disclosure vulnerability affects the 'Configservice APIs' in
the Administrative Console' component. (PK84999)\n\n - An unspecified vulnerability
affects the 'Security' component, which permits 'non-standard HTTP methods'.
(PK773246)\n\n - A security-bypass vulnerability when users use JAX-WS applications
with a WS-Security policy set at the operational level. (PK87767)\n\n - A denial-of-service
vulnerability caused because the application uses insecure obfuscation in web services.
(PK79275)\n\n - An information disclosure vulnerability affecting the Migration
component when WAS is migrated from version 6.1 to 7.0 and tracing is enabled.
(PK80337)\n\n - A security-bypass issue caused by an error in the Single Sign-on with
SPNEGO implementation. (PK77465)\n\n - A security-bypass vulnerability due to an
unspecified error when configured with CSIv2 Security with Identity Assertion.
(PK83097)\n\nFor your information, the installed version of WebSphere is : \n %L
Solution: Apply Fix Pack 25 (6.1.0.25) or later.
CVE-2009-0904
RT: Request Tracker 'ShowConfigTab' Security Bypass
PVS ID: 5078 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is running a web application that is affected by a security
bypass vulnerability.\n\nThe remote host is running RT: Request Tracker, an
enterprise-grade ticketing system. The version detected is affected by a security bypass
vulnerability because the 'ShowConfigTab' right unintentionally enabled users to edit
global RT at a Glance. An attacker could exploit this to edit the application's configuration.
For your information, the reported version of RT is : \n %L
Solution: Upgrade to RT 3.6.8 / 3.8.4
CVE Not available
Google Chrome < 1.0.154.53 Multiple Vulnerabilities
PVS ID: 5079 FAMILY: Web Clients
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:39499
Description: Synopsis : \n\nThe remote host contains a web browser that is vulnerable to multiple attack
vectors.\n\nThe version of Google Chrome installed on the remote host is earlier than
1.0.154.53. Such versions are reportedly affected by a multiple vulnerabilities : \n\n - The
browser uses the HTTP Host header to determine the context of a 4xx/5xx CONNECT
response from a proxy server. This could allow a man-in-the-middle attacker to execute
arbitrary script code in the context of a legitimate server. (CVE-2009-2060)\n\n - The
browser displays a cached certificate for 4xx/5xx CONNECT response pages from a proxy
server. A man-in-the-middle attacker could exploit this by displaying a spoofed web page
with the valid certificate of a legitimate website.\n\n For your information, the reported
Family Internet Services 1346