254 matches found
Apache Tomcat FORM身份验证安全绕过漏洞
BUGTRAQ ID: 56812 CVECAN ID: CVE-2012-3546 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Tomcat v7.0.30、6.0.36之前版本在FORM身份验证的实现上存在安全漏洞。在使用FORM验证时，若其他组件（如Single-Sign-On）在调用FormAuthenticatorauthenticate之前调用了request.setUserPrincipal，则攻击者可以通过在URL结尾添加"/jsecuritycheck"以绕过FORM验证 0 Apache Group Tomcat 7.0.0 - 7.0.2...
tomcat -- bypass of security constraints
The Apache Software Foundation reports: When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending "/jsecuritycheck" to the end of the URL if some other component such as the Single-Sign-On valve had called request.setUserPrincip...
Apache Tomcat 6.0.x < 6.0.36 Multiple Vulnerabilities
Binary data 800612.prm...
Apache Tomcat 7.0.0 < 7.0.30 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 7.0.30. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat7.0.30security-7 advisory. - Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in...
CVE-2012-2012
HP System Management Homepage (SMH) versions before 7.1.1 are affected by CVE-2012-2012 due to the absence of an off autocomplete attribute for unspecified form fields, enabling remote attackers to gain access by abusing an unattended workstation. The vulnerability is documented across multiple s...
b2ePMS 1.0 SQL Injection
Title: b2ePMS 1.0 multiple SQLi Vulnerabilities Version: 1.0 Author/Found by: loneferret Manifacturer/Software link: https://developer.berlios.de/projects/b2epms/ Other vulnerability: http://www.exploit-db.com/exploits/18882/ Date found: May 27th 2012 Tested on: Ubuntu Server 8.04 / PHP Version...
b2ePMS 1.0 multiple SQLi Vulnerabilities
Exploit for php platform in category web applications Title: b2ePMS 1.0 multiple SQLi Vulnerabilities Version: 1.0 Author/Found by: loneferret Manifacturer/Software link: https://developer.berlios.de/projects/b2epms/ Other vulnerability: http://www.exploit-db.com/exploits/18882/ Date found: May...
Seeker Advisory: Insecure Redirect in .NET Form Authentication - Redirect From Login Mechanism (ReturnURL Parameter)
Seeker Research Center Security Advisory By Irene Abezgauz =========== I. Overview =========== An Insecure Redirect vulnerability has been identified in the .NET Form Authentication - in the Redirect From Login mechanism. This vulnerability allows an attacker to craft links that contain redirects...
.NET Form Authentication Insecure Redirect
Seeker Research Center Security Advisory By Irene Abezgauz =========== I. Overview =========== An Insecure Redirect vulnerability has been identified in the .NET Form Authentication - in the Redirect From Login mechanism. This vulnerability allows an attacker to craft links that contain redirects...
Microsoft .Net Form Authentication Insecure Redirect (MS11-100; CVE-2011-3415)
A spoofing vulnerability has been reported in Microsoft .NET Framework. The vulnerability is due to an error in the way .NET Framework verifies return URLs during the forms authentication process. A remote attacker may exploit this vulnerability by enticing users to open a malicious link...
tomcat6 Information disclosure in authentication classes
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /jsecuritycheck with malformed URL encoding of passwords, related to improper error checking in the 1...
tomcat6 Information disclosure in authentication classes
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /jsecuritycheck with malformed URL encoding of passwords, related to improper error checking in the 1...
tomcat6 Information disclosure in authentication classes
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /jsecuritycheck with malformed URL encoding of passwords, related to improper error checking in the 1...
tomcat6 Information disclosure in authentication classes
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /jsecuritycheck with malformed URL encoding of passwords, related to improper error checking in the 1...
Apache Tomcat - Form Authentication Username Enumeration
Apache Tomcat - Form Authentication Username Enumeration Attackers can use readily available tools to exploit this issue. The following example POST data is available: POST /jsecuritycheck HTTP/1.1 Host: www.example.com jusername=tomcat&jpassword=%...
Apache Tomcat Form Authentication Username Enumeration Weakness
Exploit for unknown platform in category remote exploits =============================================================== Apache Tomcat Form Authentication Username Enumeration Weakness =============================================================== Title: Apache Tomcat Form Authentication Usernam...
Apache Tomcat Form Authentication Username Enumeration Weakness
No description provided by source. Attackers can use readily available tools to exploit this issue. The following example POST data is available: POST /jsecuritycheck HTTP/1.1 Host: www.example.com jusername=tomcat&jpassword=%...
Apache Tomcat - Form Authentication 'Username' Enumeration
Attackers can use readily available tools to exploit this issue. The following example POST data is available: POST /jsecuritycheck HTTP/1.1 Host: www.example.com jusername=tomcat&jpassword=%...
tomcat6 Information disclosure in authentication classes
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /jsecuritycheck with malformed URL encoding of passwords, related to improper error checking in the 1...
tomcat6 Information disclosure in authentication classes
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /jsecuritycheck with malformed URL encoding of passwords, related to improper error checking in the 1...