167 matches found
CVE-2007-5797
Apache Geronimo 2.0–2.1 is affected by CVE-2007-5797 due to a SQLLoginModule/LoginModule path that does not throw an exception for a nonexistent username. This results in remote authentication bypass, permitting a login attempt with any username not in the database to succeed. The concrete descri...
CVE-2007-5797
SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database...
Authentication flaw
Unspecified vulnerability in the management EJB MEJB in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors...
CVE-2007-5085
Unspecified vulnerability in the management EJB MEJB in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors...
CVE-2007-5085
Unspecified vulnerability in the management EJB MEJB in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors...
CVE-2007-5085
CVE-2007-5085 affects Apache Geronimo’s management EJB (MEJB) and is exploitable before version 2.0.2. The vulnerability allows remote attackers to bypass authentication and gain access to Geronimo internals via unspecified vectors. Affected component is MEJB in Geronimo prior to 2.0.2; root caus...
CVE-2007-5085: Improper Authentication
Unspecified vulnerability in the management EJB MEJB in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors...
Authentication flaw
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with...
CVE-2007-4548
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with...
CVE-2007-4548
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with...
CVE-2007-4548
CVE-2007-4548 : Apache Geronimo 2.0’s LoginModule implementations do not throw FailedLoginException on failed logins, allowing remote authentication bypass and unauthorized module deployment/gain of admin access by sending a blank username/password via the deployment module. Related advisories (e...
CVE-2007-4548: Improper Authentication
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with...
Apache Geronimo跨站脚本和HTML注入漏洞
BUGTRAQ ID: 16260 Apache Geronimo是Apache软件基金会的开放源码J2EE服务器。 Apache Geronimo由于没有正确的验证用户输入，导致Geronimo中存在跨站脚本和HTML注入漏洞，远程攻击者可以利用这些漏洞执行任意代码或窃取敏感信息。 Apache Group Geronimo 1.0 Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
tomcat examples XSS
Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...
tomcat examples XSS
Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...
geronimo_css.txt
Apache Geronimo 1.0 - CSS and persistent HTML-Injection vulnerabilities ======================================================================== Product: ======== Apache Geronimo is the J2EE server project of the Apache Software Foundation. Version: ======== Apache Geronimo 1.0, Jetty 5.1.9...
CVE-2006-0254
Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...
CVE-2006-0254
CVE-2006-0254 describes cross-site scripting in Apache Geronimo 1.0 via the time parameter to cal2.jsp and any invalid parameter, exploitable when the log file is viewed in the Web-Access-Log viewer. Related OSV/GHSA entries confirm XenS issues and note that Geronimo 1.1 contains fixes. Remediati...
CVE-2006-0254
Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...