Apache Geronimo跨站脚本和HTML注入漏洞

BUGTRAQ ID: 16260 Apache Geronimo是Apache软件基金会的开放源码J2EE服务器。 Apache Geronimo由于没有正确的验证用户输入，导致Geronimo中存在跨站脚本和HTML注入漏洞，远程攻击者可以利用这些漏洞执行任意代码或窃取敏感信息。 Apache Group Geronimo 1.0 Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

geronimo_css.txt

Apache Geronimo 1.0 - CSS and persistent HTML-Injection vulnerabilities ======================================================================== Product: ======== Apache Geronimo is the J2EE server project of the Apache Software Foundation. Version: ======== Apache Geronimo 1.0, Jetty 5.1.9...

CVE-2006-0254

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

CVE-2006-0254

CVE-2006-0254 describes cross-site scripting in Apache Geronimo 1.0 via the time parameter to cal2.jsp and any invalid parameter, exploitable when the log file is viewed in the Web-Access-Log viewer. Related OSV/GHSA entries confirm XenS issues and note that Geronimo 1.1 contains fixes. Remediati...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

CVE-2006-0254

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

Geronimo Console Default Credentials

The remote host appears to be running Geronimo, an open source J2EE server from the Apache Software Foundation. The installation of Geronimo on the remote host uses the default username and password to control access to its administrative console. Knowing these, an attacker can gain control of th...

Apache Tomcat / Geronimo Sample Script cal2.jsp time Parameter XSS

The remote host appears to be running Geronimo, an open source J2EE server from the Apache Software Foundation. The version of Geronimo installed on the remote host includes a JSP application that fails to sanitize user-supplied input to the 'time' parameter before using it to generate a dynamic...

Apache Geronimo 1.0 - Error Page Cross-Site Scripting

source: https://www.securityfocus.com/bid/16260/info Apache Geronimo is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit could allow an attacker to compromise the application, access or modify data, or...

Apache Tomcat / Geronimo 1.0 - 'Sample Script cal2.jsp?time' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16260/info Apache Geronimo is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit could allow an attacker to compromise the application, access or modify data, or...

Apache Tomcat Geronimo 1.0 - Sample Script cal2.jsp?time Cross-Site Scripting

Apache Tomcat Geronimo 1.0 - Sample Script cal2.jsp?time Cross-Site Scripting source: https://www.securityfocus.com/bid/16260/info Apache Geronimo is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit cou...

Apache Geronimo 1.0 - Error Page Cross-Site Scripting

Apache Geronimo 1.0 - Error Page Cross-Site Scripting source: https://www.securityfocus.com/bid/16260/info Apache Geronimo is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit could allow an attacker to...