[SECURITY] [DSA 3892-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3892-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3891-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3891-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 22, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3891-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3891-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 22, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3891-1 (tomcat8 - security update)

Aniket Nandkishor Kulkarni discovered that in tomcat8, a servlet and JSP engine, static error pages used the original request OpenVAS Vulnerability Test $Id: deb3891.nasl 6607 2017-07-07 12:04:25Z cfischer $ Auto-generated from advisory DSA 3891-1 using nvtgen 1.0 Script version: 1.0 Author:...

Debian: Security Advisory (DSA-3891-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 996-1] tomcat7 security update

Package : tomcat7 Version : 7.0.28-4+deb7u14 CVE ID : CVE-2017-5664 Debian Bug : 864447 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to th...

Apache Tomcat security restrictions bypass Vulnerability, CVE-2017-5664-a vulnerability warning-the black bar safety net

Apache Tomcat security restrictions bypass Vulnerability, CVE-2017-5664） Release date: 2017-06-12 Update date: 2017-06-12 Affected system: Apache Group Tomcat 9.0.0. M1-9.0.0. M20 Apache Group Tomcat 8.5.0-8.5.14 Apache Group Tomcat 8.0.0. RC1-8.0.43 Apache Group Tomcat 7.0.0-7.0.77 Description:...

CVE-2017-5664

CVE-2017-5664 affects Apache Tomcat and concerns the error page mechanism. The DefaultServlet failed to forward error pages with the original request method across multiple releases (Tomcat 9.0.0.M1–9.0.0.M20, 8.5.0–8.5.14, 8.0.0.RC1–8.0.43, 7.0.0–7.0.77), which could lead to unexpected results f...

[ASA-201706-7] tomcat8: access restriction bypass

Arch Linux Security Advisory ASA-201706-7 ========================================= Severity: High Date : 2017-06-06 CVE-ID : CVE-2017-5664 Package : tomcat8 Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-291 Summary ======= The package tomcat8 before...

[ASA-201706-6] tomcat7: access restriction bypass

Arch Linux Security Advisory ASA-201706-6 ========================================= Severity: High Date : 2017-06-06 CVE-ID : CVE-2017-5664 Package : tomcat7 Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-290 Summary ======= The package tomcat7 before...

Fixed in Apache Tomcat 8.0.44

Important: Security Constraint Bypass CVE-2017-5664 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the...

Fixed in Apache Tomcat 9.0.0.M21

Important: Security Constraint Bypass CVE-2017-5664 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the...

CVE-2016-5664

CVE-2016-5664 affects Accellion Kiteworks appliances prior to kw2016.03.00. The vulnerability is a directory traversal flaw that allows an unauthenticated remote attacker to read files outside the webroot via a crafted URI. Public sources (NVD) assign a network-based, low- to moderate-severity im...

CVE-2015-5664

Cross-site scripting XSS vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5664

CVE-2015-5664 is a cross-site scripting (XSS) vulnerability in QNAP QTS File Station prior to 4.2.0. Multiple connected sources (JVN/JVNDB, CNVD, OpenVAS, Tenable/NASL) confirm that remote attackers can inject arbitrary script/HTML via unspecified vectors, potentially affecting web browser sessio...

CVE-2015-5664

Cross-site scripting XSS vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-5664

CVE-2014-5664 affects the Android app Spider Solitaire (com.mobilityware.spider) version 3.0.0, which does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The NVD records a MEDIUM ...

Realtek Media Player Playlist Buffer Overflow

No description provided by source. $Id: realtekplaylist.rb 11127 2010-11-24 19:35:38Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of...

openSUSE Security Update : ruby (openSUSE-SU-2013:0278-1)

This update updates the RubyOnRails 2.3 stack to 2.3.16, also this update updates the RubyOnRails 3.2 stack to 3.2.11. Security and bugfixes were done, foremost: CVE-2013-0333: A JSON sql/code injection problem was fixed. CVE-2012-5664: A SQL Injection Vulnerability in Active Record was fixed...

CVE-2013-5664

CVE-2013-5664 affects Palo Alto Networks PAN-OS web-based device-management API browser. The vulnerability is a cross-site scripting (XSS) flaw where user-supplied input is not properly sanitized, allowing remote attackers to inject arbitrary script/HTML via crafted data. Affected versions are PA...