Password is being logged for 500 errors

The user passwords are being exposed in the log files when a 500 error happens. The following Jira solved the problem for the information displayed in the user Browser: http://jira.atlassian.com/browse/CONF-12360...

Get 500 when trying to communicate to confluence via trusted apps.

Steps to reproduce. 1 Install confluence 2.9.2 and crucible 1.6.5 2 Setup trusted apps to crucible specify a "IP address Matches as 10.0.100.123 3 Install the confluence crucible plugin...

Get 500 when trying to communicate to confluence via trusted apps.

Steps to reproduce. 1 Install confluence 2.9.2 and crucible 1.6.5 2 Setup trusted apps to crucible specify a "IP address Matches as 10.0.100.123 3 Install the confluence crucible plugin...

Get 500 when trying to communicate to confluence via trusted apps.

Steps to reproduce. 1 Install confluence 2.9.2 and crucible 1.6.5 2 Setup trusted apps to crucible specify a "IP address Matches as 10.0.100.123 3 Install the confluence crucible plugin...

Logging event information is not HTML encoded in 500 error page

The Confluence 500 error page lists logging events generated during the request the produced the 500 error page. The strings rendered from this event are not HTML encoded, leaving open a chance for an attacker to exploit this via XSS. I haven't yet investigated to see whether this is actually...

Microsoft Exchange OWA 长用户名拒绝服务漏洞

微软Exchange OWAOutlook Web Access组件存在一个拒绝服务漏洞。当使用很多"%"作 为用户名和口令登录时，OWA会返回HTTP 500 - Internal server error信息。用户将不 能通过IE进行登录。据报告说WWW发布服务和IIS管理服务会停止响应。 Microsoft Exchange Server 5.5 SP4 Microsoft Exchange Server 5.5 SP3 Microsoft Exchange Server 5.5 SP2 Microsoft Exchange Server 5.5 SP1 Microsoft...

CVE-2008-1111

modcgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information...

Cisco Security Advisory: Cisco PIX and ASA Time-to-Live Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco PIX and ASA Time-to-Live Vulnerability Advisory ID: cisco-sa-20080123-asa http://www.cisco.com/warp/public/707/cisco-sa-20080123-asa.shtml Revision 1.0 For Public Release 2008 January 23 1600 UTC GMT...

CVE-2008-0028

Unspecified vulnerability in Cisco PIX 500 Series Security Appliance and 5500 Series Adaptive Security Appliance ASA before 7.236 and 8.03, when the Time-to-Live TTL decrement feature is enabled, allows remote attackers to cause a denial of service device reload via a crafted IP packet...

PT-2008-1691 · Cisco · Cisco 5500 Series Adaptive Security Appliance +2

Name of the Vulnerable Software and Affected Versions: Cisco PIX 500 Series Security Appliance versions prior to 7.236 Cisco 5500 Series Adaptive Security Appliance ASA versions prior to 8.03 Description: The issue allows remote attackers to cause a denial of service, resulting in a device reload...

Debian Security Advisory DSA 500-1 (flim)

The remote host is missing an update to flim announced via advisory DSA 500-1. OpenVAS Vulnerability Test $Id: deb5001.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 500-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

CVE-2003-1482

The backup configuration file for Microsoft MN-500 wireless base station stores administrative passwords in plaintext, which allows local users to gain access...

CVE-2003-1482

CVE-2003-1482 affects the Microsoft MN-500 wireless base station. The issue is that the backup configuration file stores administrative passwords in plaintext, which enables local users to gain access. The available connected documents corroborate this exact description; no public details about a...

CVE-2007-4598

IBM SurePOS 500 has 1 a default password of "12345" for the manager and 2 blank default passwords for operator accounts...

Default credentials

IBM SurePOS 500 has 1 a default password of "12345" for the manager and 2 blank default passwords for operator accounts...

CVE-2007-4598

CVE-2007-4598 affects IBM SurePOS 500. The vulnerability arises from default credentials: manager account uses 12345 and operator accounts have blank default passwords. Impact is partial confidentiality, integrity, and availability since unauthorized local access could be gained through these cre...

CVE-2007-4598

IBM SurePOS 500 has 1 a default password of "12345" for the manager and 2 blank default passwords for operator accounts...

PT-2007-5758 · Ibm · Ibm Surepos 500

Name of the Vulnerable Software and Affected Versions: IBM SurePOS 500 affected versions not specified Description: The issue concerns default password settings. Specifically, it has a default password of "12345" for the manager and blank default passwords for operator accounts. Recommendations:...

CVE-2007-1504

Cross-site scripting XSS vulnerability in the Servlet Service in Fujitsu Interstage Application Server IJServer 8.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving web.xml and HTTP 404 and 500 status codes...

Code injection

Cisco PIX 500 and ASA 5500 Series Security Appliances 7.2.2, when configured to inspect certain TCP-based protocols, allows remote attackers to cause a denial of service device reboot via malformed TCP packets...