GHSA-2JXH-3CX8-XW65 Apache Geronimo console 1.0 vulnerable to cross-site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer. Version 1.1 contai...

geronimo:geronimo-console (>=1.0-m5, <=1.0) potentially affected by CVE-2006-0254 via geronimo:geronimo-console-standard (>=1.0-m5, <=1.0)

geronimo:geronimo-console-standard MAVEN version =1.0-m5, =1.0-m5, =1.0 Source cves: CVE-2006-0254 Source advisory: GHSA-2JXH-3CX8-XW65...

activemq:activemq-core (3.2), activemq:activemq-gbean (3.2) +30 more potentially affected by CVE-2005-4849 via org.apache.derby:derby (10.1.1.0)

org.apache.derby:derby MAVEN version 10.1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.derby:derby and may be impacted: - activemq:activemq-core 3.2 - activemq:activemq-gbean 3.2 - activemq:activemq-optional 3.2 -...

com.taobao.tair:tair-client (>=2.3.4, <=2.3.5), com.taobao.tair:tair3-client (3.0.1.14) +12 more potentially affected by CVE-2021-41973 via org.apache.mina:mina-core (1.1.5)

org.apache.mina:mina-core MAVEN version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - com.taobao.tair:tair-client =2.3.4, =2.3.4.4, =2.1.2, =2.1.8 - org.apache.mina:mina-example 1.1.5 -...

org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 (3.0-m1), org.apache.geronimo.assemblies:geronimo-jetty8-minimal (3.0-m1) +78 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (8.0.0.m0)

org.eclipse.jetty:jetty-server MAVEN version 8.0.0.m0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 3.0-m1 -...

3.6 bug fix and enhancement update

An update is available for apache-commons-io, atinject, jsr-305, maven-shared-utils, plexus-cipher, aopalliance, plexus-classworlds, guava, apache-commons-cli, plexus-containers, plexus-sec-dispatcher, httpcomponents-client, maven-resolver, apache-commons-lang3, plexus-interpolation, sisu,...

Medium: geronimo-jaxrpc

Issue Overview: Liblouis 3.5.0 has a Segmentation fault in loulogPrint in logging.c. CVE-2018-11577 Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c. CVE-2018-11684 Liblouis 3.5.0 has a stack-based Buffer Overflow in the function...

apache-geronimo.328035.n3.nabble.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1184944 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Security Bulletin: Multiple Security Vulnerabilities in Apache Geronimo Affect IBM Sterling B2B Integrator

Summary Multiple Security Vulnerabilities in Apache Geronimo Affect IBM Sterling B2B Integrator Vulnerability Details CVEID: CVE-2008-0732 DESCRIPTION: Apache Geronimo could allow a local attacker to obtain sensitive information, caused by the init script following symlinks during a chown...

Authentication Bypass

geronimo is vulnerable to authentication bypass. A remote attacker is able to bypass the login function by attempting to login using a non-existent username...

Cross-Site Scripting (XSS)

geronimo is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the name, ip, username or description parameters in console/portal/Server/Monitoring, and PATHINFO parameter to the default URI under console/portal/...

Authentication Bypass

geronimo is vulnerable to authentication bypass. A remote attacker is able to bypass authentication to obtain access to Geronimo internals and retrieve confidential information...

Directory Traversal

Apache Geronimo web administration console is vulnerable to directory traversal. The vulnerabilty is possible because it does not validate the input to the web administrative console, allowing a remote attacker to upload any file in any directory...

Cross-Site Request Forgery (CSRF)

Apache Geronimo application server is vulnerable to cross-site request forgery. Attackers can exploit the vulnerability to obtain sensitive information, upload arbitrary files, execute arbitrary script code, steal cookie-based authentication credentials, or perform certain administrative actions...

Authentication Bypass

Apache Geronimo is vulnerable to authentication bypass. This is caused by improper exception handling for failed logins, which would allow a remote attacker to bypass authentication requirements and deploy arbitrary modules and gain administrative access by submitting a blank username and passwor...

Cross-Site Scripting (XSS)

Apache Geronimo is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into log files via the time parameter or any invalid parameters to cal2.jsp. The injected Javascript executes on the victim's browser when the log files are viewed through the...

org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 (3.0-m1), org.apache.geronimo.assemblies:geronimo-jetty8-minimal (3.0-m1) +78 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (8.0.0.m0)

org.eclipse.jetty:jetty-server MAVEN version 8.0.0.m0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 3.0-m1 -...

org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 (3.0-m1), org.apache.geronimo.assemblies:geronimo-jetty8-minimal (3.0-m1) +78 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (8.0.0.m0)

org.eclipse.jetty:jetty-server MAVEN version 8.0.0.m0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 3.0-m1 -...

org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 (3.0-m1), org.apache.geronimo.assemblies:geronimo-jetty8-minimal (3.0-m1) +78 more potentially affected by CVE-2017-7656 via org.eclipse.jetty:jetty-server (8.0.0.m0)

org.eclipse.jetty:jetty-server MAVEN version 8.0.0.m0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.geronimo.assemblies:geronimo-jetty8-javaee6 3.0-m1 -...

com.jolira:testing-tools (1.2.5), org.apache.geronimo.assemblies:geronimo-jetty7-javaee5 (2.2.1) +155 more potentially affected by CVE-2017-7656 via org.eclipse.jetty:jetty-server (7.2.1.v20101111)

org.eclipse.jetty:jetty-server MAVEN version 7.2.1.v20101111 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.jolira:testing-tools 1.2.5 - org.apache.geronimo.assemblies:geronimo-jetty7-javaee5...