Fix header injection vulnerabilities

A number of vulnerabilities were found during JRA-16024 which expose JIRA to header injection attacks: Note that different application server configurations may expose or hide the presence of a header injection vulnerability. Standalone tomcat is usually not vulnerable. Tomcat 5.5.26 redirects al...

OpenJDK applet privilege escalation via JAX package access (6592792)

Multiple unspecified vulnerabilities in Java Runtime Environment JRE for Sun JDK and JRE 6 Update 10 and earlier allow untrusted applets and applications to gain privileges via vectors related to access to inner classes in the 1 JAX-WS and 2 JAXB packages...

CVE-2008-5347

Technical details for CVE-2008-5347 are not provided in the supplied documents; no affected product/version specifics beyond the initial description. Monitor for updates.

CVE-2008-5347

Multiple unspecified vulnerabilities in Java Runtime Environment JRE for Sun JDK and JRE 6 Update 10 and earlier allow untrusted applets and applications to gain privileges via vectors related to access to inner classes in the 1 JAX-WS and 2 JAXB packages...

OpenJDK applet privilege escalation via JAX package access (6592792)

Multiple unspecified vulnerabilities in Java Runtime Environment JRE for Sun JDK and JRE 6 Update 10 and earlier allow untrusted applets and applications to gain privileges via vectors related to access to inner classes in the 1 JAX-WS and 2 JAXB packages...

CVE-2008-4719: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in cms/classes/openengine/filepool.php in openEngine 2.0 beta2, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the oeclasspath parameter, a different vector than CVE-2008-4329...

[SECURITY] Fedora 8 Update: rubygem-activeresource-2.1.1-1.fc8

Wraps web resources in model classes that can be manipulated through XML ov er REST...

CVE-2008-4529

Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP code via a URL in the ENVasicmspath parameter to 1 Association.php, 2 BigMath.php, 3 DiffieHellman.php, 4 DumbStore.php, 5 Extension.php, 6 FileStore.php, 7 HMAC.php, 8...

CVE-2008-4529: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in asiCMS alpha 0.208 allow remote attackers to execute arbitrary PHP code via a URL in the ENVasicmspath parameter to 1 Association.php, 2 BigMath.php, 3 DiffieHellman.php, 4 DumbStore.php, 5 Extension.php, 6 FileStore.php, 7 HMAC.php, 8...

asiCMS alpha 0.208 Multiple Remote File Inclusion Vulnerabilities

No description provided by source. =========================================================================================== o asiCMS alpha 0.208 Multiple Remote File Inclusion Vulnerability Software : asiCMS version alpha 0.208 Vendor : http://asicms.sourceforge.net/ Download :...

asiCMS alpha 0.208 - Multiple Remote File Inclusions

asiCMS alpha 0.208 - Multiple Remote File Inclusions =========================================================================================== o asiCMS alpha 0.208 Multiple Remote File Inclusion Vulnerability Software : asiCMS version alpha 0.208 Vendor : http://asicms.sourceforge.net/ Download...

[SECURITY] Fedora 9 Update: rubygem-activeresource-2.1.1-1.fc9

Wraps web resources in model classes that can be manipulated through XML ov er REST...

openEngine 2.0 beta2 Remote File Inclusion Vulnerability

No description provided by source. Author : By CrackersChild Contact: [email protected] Greetz : str0ke & All My Friends Script : openEngine 2. 0 beta2 Remote File include Vulnerable Download :http://downloads.sourceforge.net/openengine/openengine20beta2.zip?modtime=1203083918&bigmirror=0...

JBossEAP allows download of non-EJB class files

The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform aka JBossEAP or EAP, possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain...

CVE-2008-3675: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in classes/imgsize.php in Gelato 0.95 allows remote attackers to read arbitrary files via 1 a .. dot dot and possibly 2 a full pathname in the img parameter. NOTE: some of these details are obtained from third party information...

javaws vulnerabilities

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...

CVE-2008-2899

Technical details for CVE-2008-2899 are not publicly provided in the supplied documents. The initial description is generic, and connected records do not expose affected product specifics, root cause, or remediation.

CVE-2008-2899: Undefined Security Weakness

Unspecified vulnerability in includes/classes/page.php in j00lean-CMS 1.03 has unknown impact and attack vectors...

Java Web Start vulnerable to execution of unauthorized system classes

Overview Java Web Start, included in the JRE Java Runtime Environment from Sun Microsystems and other products, contains a vulnerability allowing unauthorized execution of system classes. Java Web Start, included in the JRE Java Runtime Environment and other products, is a tool for distributing...

javaws vulnerabilities

Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.213 and earlier, allows remote attackers to perform unauthorized actions via an application that grants privileges to itself, related to "Incorrect Use of System Classes" and probably related to...