150 matches found
SuSE 10 Security Update : Tomcat 5 (ZYPP Patch Number 4990)
Cross-site scripting XSS vulnerability in example JSP applications. CVE-2006-7196 - Handling of cookies containing a ' character. CVE-2007-3382 - Handling of ' in cookies. CVE-2007-3385 - tomcat path traversal / information leak. CVE-2007-5641 - directory traversal. CVE-2007-1860 - tomcat https...
Debian: Security Advisory (DSA-1468-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2008-0128
The SingleSignOn Valve org.apache.catalina.authenticator.SingleSignOn in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie...
CVE-2008-0128
Apache Tomcat 5.x before 5.5.21 is affected by CVE-2008-0128: when the SingleSignOn valve is used over HTTPS, the JSESSIONIDSSO cookie is not marked secure, allowing it to be sent over HTTP and potentially captured by an attacker via a crafted HTTP request. This information is supported by multip...
Fixed in Apache Tomcat 5.5.21
Moderate: Session hi-jacking CVE-2008-0128 When using the SingleSignOn Valve via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server. Affects:...
[SECURITY] [DSA 1468-1] New tomcat5.5 packages fix several vulnerabilities
------------------------------------------------------------------------ Debian Security Advisory DSA-1468-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 20, 2008 http://www.debian.org/security/faq -...
tzdata security update
CentOS Errata and Security Advisory CESA-2007:0128-03 Merged security bulletin from advisories: https://lists.centos.org/pipermail/centos-announce/2007-March/075799.html Affected packages: tzdata...
Fixed in Apache Tomcat 6.0.9
Moderate: Session hi-jacking CVE-2008-0128 When using the SingleSignOn Valve via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server. Affects:...
CVE-2007-0128
SQL injection vulnerability in infobook.asp in Digirez 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the bookid parameter...
CVE-2007-0128
CVE-2007-0128 describes an SQL injection vulnerability in info_book.asp for Digirez 3.4 and earlier, where the book_id parameter can be manipulated to execute arbitrary SQL commands remotely. Affected software is Digirez (versions up to 3.4 and earlier); the underlying root cause is improper hand...
CVE-2006-0128
Rockliffe MailSite IMAP service (affected: versions before 6.1.22.1) is vulnerable to a buffer overflow. The vulnerability arises in the IMAP component, with a remote attacker able to trigger an overflow; the exact impact and attack vectors are not specified in the provided documents. No explicit...
CVE-2004-0128
PHP remote file inclusion vulnerability in the GEDCOM configuration script for phpGedView 2.65.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the PGVBASEDIRECTORY parameter to reference a URL on a remote web server that contains a malicious theme.php script...
CVE-2004-0128
CVE-2004-0128 affects PhpGedView (GEDCOM configuration script) up to version 2.65.1. The vulnerability arises when PGV_BASE_DIRECTORY is set to reference a URL on a remote server, allowing remote attackers to execute arbitrary PHP code by loading a malicious theme.php. The connected records corro...
CVE-2004-0128
PHP remote file inclusion vulnerability in the GEDCOM configuration script for phpGedView 2.65.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the PGVBASEDIRECTORY parameter to reference a URL on a remote web server that contains a malicious theme.php script...
CVE-2003-0128
The tryuudecoding function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a malicious uuencoded UUE header, possibly triggering a heap-based buffer overflow...
CVE-2003-0128
The CVE-2003-0128 family affects Ximian Evolution Mail User Agent (MUA) prior to version 1.2.3, via the try_uudecoding function in mail-format.c that decodes UUEncoded headers. The vulnerability can cause a denial of service (crash) and may allow arbitrary code execution through crafted UUE heade...
CVE-2003-0128
The tryuudecoding function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a malicious uuencoded UUE header, possibly triggering a heap-based buffer overflow...
CVE-2002-0128
CVE-2002-0128 affects Sambar Server 5.1 prior to Beta 4, where the CGI component cgitest.exe (and related CGI entries) is vulnerable to a long-argument input. This can cause a denial of service and, per some sources, may allow arbitrary code execution. The vulnerability’s impact is consistent acr...