Caucho Technology Resin 1.2/1.3 JavaBean Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2533/info A specially constructed HTTP request could enable a remote attacker to gain read access to any known JavaBean file residing on a host running Resin. On Resin webservers, JavaBean files reside in a protected...

CVE-2010-2032: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in resin-admin/digest.php in Caucho Technology Resin Professional 3.1.5, 3.1.10, 4.0.6, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the 1 digestrealm or 2 digestusername parameters. NOTE: some of...

Caucho Technology Resin digest.php Cross Site Scripting Vulnerability

This vulnerability do not need to login.digest.php use the REQUEST method in a wrong way to accept parametersthe malicious user could submit xss code on this page and an attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. exp:...

CVE-2003-1513

Multiple cross-site scripting XSS vulnerabilities in example scripts in Caucho Technology Resin 2.0 through 2.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 env.jsp, 2 form.jsp, 3 session.jsp, 4 the move parameter to tictactoe.jsp, or the 5 name or 6 comment fields to...

CVE-2003-1513

CVE-2003-1513 concerns multiple XSS vulnerabilities in Caucho Technology Resin 2.0–2.1.2, exposed via example scripts (env.jsp, form.jsp, session.jsp, tictactoe.jsp with the move parameter, and guestbook.jsp with name/comment fields). The root cause is the failure to properly sanitize user-suppli...

CVE-2002-2090

Caucho Technology Resin server 2.1.1 to 2.1.2 allows remote attackers to obtain server's root path via requests for MS-DOS device names such as lpt9.xtp...

CVE-2002-2090: Undefined Security Weakness

Caucho Technology Resin server 2.1.1 to 2.1.2 allows remote attackers to obtain server's root path via requests for MS-DOS device names such as lpt9.xtp...

CVE-2000-1224: Undefined Security Weakness

Caucho Technology Resin 1.2 and possibly earlier allows remote attackers to view JSP source via an HTTP request to a .jsp file with certain characters appended to the file name, such as 1 "..", 2 "%2e..", 3 "%81", 4 "%82", and others...

CVE-2004-0281

Caucho Technology Resin 2.1.12 allows remote attackers to gain sensitive information and view the contents of the /WEB-INF/ directory via an HTTP request for "WEB-INF..", which is equivalent to "WEB-INF" in Windows...

CVE-2004-0281

Caucho Technology Resin 2.1.12 allows remote attackers to gain sensitive information and view the contents of the /WEB-INF/ directory via an HTTP request for "WEB-INF..", which is equivalent to "WEB-INF" in Windows...

CVE-2004-0281

CVE-2004-0281 affects Caucho Resin (2.1.12) and is a path traversal vulnerability that allows remote disclosure of files under the /WEB-INF/ directory by requesting WEB-INF.., effectively bypassing directory boundaries. The core issue is improper normalization of path traversal sequences, enablin...

CVE-2004-0280: Undefined Security Weakness

Caucho Technology Resin 2.1.12 allows remote attackers to view JSP source via an HTTP request to a .jsp file that ends in a "%20" encoded space character, e.g. index.jsp%20...

CVE-2004-0281: Undefined Security Weakness

Caucho Technology Resin 2.1.12 allows remote attackers to gain sensitive information and view the contents of the /WEB-INF/ directory via an HTTP request for "WEB-INF..", which is equivalent to "WEB-INF" in Windows...

CVE-2003-1513

Multiple cross-site scripting XSS vulnerabilities in example scripts in Caucho Technology Resin 2.0 through 2.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 env.jsp, 2 form.jsp, 3 session.jsp, 4 the move parameter to tictactoe.jsp, or the 5 name or 6 comment fields to...

CVE-2001-0828

A cross-site scripting vulnerability in Caucho Technology Resin before 1.2.4 allows a malicious webmaster to embed Javascript in a hyperlink that ends in a .jsp extension, which causes an error message that does not properly quote the Javascript...

CVE-2001-0828: Undefined Security Weakness

A cross-site scripting vulnerability in Caucho Technology Resin before 1.2.4 allows a malicious webmaster to embed Javascript in a hyperlink that ends in a .jsp extension, which causes an error message that does not properly quote the Javascript...