Debian Security Advisory DSA 3552-1 (tomcat7 - security update)

Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections and bypass of the SecurityManager. OpenVAS Vulnerability Test $Id: deb3552.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generat...

CVE-2016-0791

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach...

Cross-site request forgery

Administrate::ApplicationController actions don't have CSRF protection. Remote attackers can hijack user's sessions and use any functionality that administrate exposes on their behalf...

Medium: tomcat7

Issue Overview: ResourceLinkFactory.setGlobalContext is a public method and was discovered to be accessible by web applications running under a security manager without any checks. This allowed a malicious web application to inject a malicious global context that could in turn be used to disrupt...

openSUSE Security Update : tomcat (openSUSE-2016-384)

This update for tomcat fixes the following issues : Tomcat 8 was updated from 8.0.23 to 8.0.32, to fix bugs and security issues. Fixed security issues : - CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat allowed remote authenticated users to bypass intended...

jenkins: CSRF protection ineffective (SECURITY-233)

Jenkins before 1.640 and LTS before 1.625.2 allow remote attackers to bypass the CSRF protection mechanism via unspecified vectors...

SUSE-SU-2016:0769-1 Security update for tomcat

This update for tomcat fixes the following issues: Tomcat 8 was updated from 8.0.23 to 8.0.32, to fix bugs and security issues. Fixed security issues: CVE-2015-5174: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat allowed remote authenticated users to bypass intended...

Fedora 21 : php-horde-horde-5.2.8-1.fc21 / php-horde-imp-6.2.11-1.fc21 / php-horde-ingo-3.2.7-1.fc21 / etc (2015-a381facfd9)

horde 5.2.8 mjr SECURITY: Protect against CSRF attacks on various admin pages. jan Don't apply access keys to checkbox and radiobox rows in the sidebar Bug 14103. jan Send correct MIME type for non-statically cached JavaScript files. mjr Added configuration support for version 2 of...

Mageia: Security Advisory (MGASA-2016-0090)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2016-0090 Updated tomcat packages fix security vulnerabilities

Updated tomcat packages fix security vulnerabilities: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 7.x before 7.0.65 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used b...

WordPress Plugin CP Polls 1.0.8 - Multiple Vulnerabilities

WordPress Plugin CP Polls 1.0.8 - Multiple Vulnerabilities Exploit Title: WordPress CP Polls 1.0.8 - CSRF - Update poll settings & Persistent XSS Date: 2016-02-22 Google Dork: Index of /wp-content/plugins/cp-polls/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Plugin URI:...

WordPress CP Polls 1.0.8 Plugin - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress CP Polls 1.0.8 - CSRF - Update poll settings & Persistent XSS Date: 2016-02-22 Google Dork: Index of /wp-content/plugins/cp-polls/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Plugin URI:...

[SECURITY] [DLA 435-1] tomcat6 security update

Package : tomcat6 Version : 6.0.45-1deb6u1 CVE ID : CVE-2015-5174 CVE-2015-5345 CVE-2015-5351 CVE-2016-0706 CVE-2016-0714 CVE-2016-0763 Tomcat 6, an implementation of the Java Servlet and the JavaServer Pages JSP specifications and a pure Java web server environment, was affected by multiple...

New Relic: CSRF - Regenerate all admin api keys

Hi The request to regenerate all admin api keys is a GET request without CSRF protection. As such, you can regenerate someone's keys using csrf. While not too big of an issue the admin can always see the keys and use them its certainly annoying and can cause business disruption. Additionally, a...

CVE-2015-5351

The 1 Manager and 2 Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token...

Apache Tomcat CSRF Token Leak Vulnerability (Feb 2016) - Windows

Apache Tomcat is prone to a cross-site request forgery CSRF token leak vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Tomcat CSRF Token Leak Vulnerability (Feb 2016) - Linux

Apache Tomcat is prone to a cross-site request forgery CSRF token leak vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ubiquiti Networks UniFi 3.2.10 Cross Site Request Forgery

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ----------------------- Product: Ubiquiti Networks UniFi Vendor URL: www.ubnt.com Type: Cross-Site Request Forgery CWE-353 Date found: 2015-03-19 Date published: 2016-02-23 CVSSv3 Score: 6.3...

Apache Tomcat 7.0.0 < 7.0.68 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 7.0.68. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat7.0.68security-7 advisory. - The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x...

Ubiquiti Networks UniFi 3.2.10 - Cross-Site Request Forgery

Exploit for hardware platform in category web applications 1. ADVISORY INFORMATION ----------------------- Product: Ubiquiti Networks UniFi Vendor URL: www.ubnt.com Type: Cross-Site Request Forgery CWE-353 Date found: 2015-03-19 Date published: 2016-02-23 CVSSv3 Score: 6.3...