tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

Design/Logic Flaw

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories...

CVE-2008-0732

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories...

CVE-2008-0732

CVE-2008-0732 concerns the init script used by Apache Geronimo on SUSE Linux. The issue arises when the script follows symlinks during a chown operation, which could allow a local attacker to obtain access to unspecified files or directories. The available connected documents confirm the vulnerab...

CVE-2008-0732

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories...

SuSE 10 Security Update : Geronimo (ZYPP Patch Number 4967)

A chown in the geronimo init script could change ownership of directories it did not own, due to following symlinks. The default setup would corrupt /var/tmp on start. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

openSUSE 10 Security Update : geronimo (geronimo-4957)

A chown in the geronimo init script could change ownership of directories it did not own, due to following symlinks. The default setup would corrupt /var/tmp on start. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

SuSE 10 Security Update : Geronimo (ZYPP Patch Number 4864)

The file 'implict-objects.jsp' displayed some header values unfiltered. Attackers could exploit that for cross-site scripting XSS attacks. CVE-2006-7195 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

Authentication flaw

SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database...

CVE-2007-5797

SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database...

CVE-2007-5797

Apache Geronimo 2.0–2.1 is affected by CVE-2007-5797 due to a SQLLoginModule/LoginModule path that does not throw an exception for a nonexistent username. This results in remote authentication bypass, permitting a login attempt with any username not in the database to succeed. The concrete descri...

CVE-2007-5797

SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database...

CVE-2007-5085

Unspecified vulnerability in the management EJB MEJB in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors...

Authentication flaw

Unspecified vulnerability in the management EJB MEJB in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors...

CVE-2007-5085

CVE-2007-5085 affects Apache Geronimo’s management EJB (MEJB) and is exploitable before version 2.0.2. The vulnerability allows remote attackers to bypass authentication and gain access to Geronimo internals via unspecified vectors. Affected component is MEJB in Geronimo prior to 2.0.2; root caus...

CVE-2007-5085

Unspecified vulnerability in the management EJB MEJB in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors...

Authentication flaw

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with...

CVE-2007-4548

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with...

CVE-2007-4548

CVE-2007-4548 : Apache Geronimo 2.0’s LoginModule implementations do not throw FailedLoginException on failed logins, allowing remote authentication bypass and unauthorized module deployment/gain of admin access by sending a blank username/password via the deployment module. Related advisories (e...

CVE-2007-4548

The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with...