Directory Traversal

Apache Geronimo web administration console is vulnerable to directory traversal. The vulnerabilty is possible because it does not validate the input to the web administrative console, allowing a remote attacker to upload any file in any directory...

Cross-Site Request Forgery (CSRF)

Apache Geronimo application server is vulnerable to cross-site request forgery. Attackers can exploit the vulnerability to obtain sensitive information, upload arbitrary files, execute arbitrary script code, steal cookie-based authentication credentials, or perform certain administrative actions...

Authentication Bypass

Apache Geronimo is vulnerable to authentication bypass. This is caused by improper exception handling for failed logins, which would allow a remote attacker to bypass authentication requirements and deploy arbitrary modules and gain administrative access by submitting a blank username and passwor...

Cross-Site Scripting (XSS)

Apache Geronimo is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into log files via the time parameter or any invalid parameters to cal2.jsp. The injected Javascript executes on the victim's browser when the log files are viewed through the...

Denial Of Service (DoS)

Apache Geronimo is vulnerable to denial of service attacks through resource consumption. This is caused because it computes hash values for form parameters without reliably predicting hash collisions. This allows attackers to cause denial of service attacks by sending multiple parameters designed...

VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)

The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components : - Apache Geronimo - Apache Tomcat - Apache Xerces2 - cURL/libcURL - ISC BIND - Libxml2 -...

CVE-2007-5797

SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database...

Apache Geronimo 2.1.x /console/portal/Server/Monitoring Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/34562/info Apache Geronimo Application Server is prone to multiple remote vulnerabilities: - Multiple directory-traversal vulnerabilities - A cross-site scripting vulnerability - Multiple HTML-injection vulnerabilities - ...

Apache Geronimo 1.0 Error Page XSS

No description provided by source. source: http://www.securityfocus.com/bid/16260/info Apache Geronimo is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit could allow an attacker to compromise the...

Apache Tomcat / Geronimo 1.0 Sample Script cal2.jsp time Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/16260/info Apache Geronimo is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. A successful exploit could allow an attacker to compromise the...

Apache Geronimo 2.1.x Multiple Admin Function CSRF

No description provided by source. source: http://www.securityfocus.com/bid/34562/info Apache Geronimo Application Server is prone to multiple remote vulnerabilities: - Multiple directory-traversal vulnerabilities - A cross-site scripting vulnerability - Multiple HTML-injection vulnerabilities - ...

PHP Hash Table Collision Proof Of Concept

No description provided by source. ! /usr/bin/env python This script was written by Christian Mehlmauer [email protected] https://twitter.com/!/FireFart Sourcecode online at: https://github.com/FireFart/HashCollision-DOS-POC Original PHP Payloadgenerator taken from...

Apache Geronimo <= 2.1.3 - Multiple Directory Traversal Vulnerabilities

No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-09-018 Application: Apache Geronimo Application Server Versions Affected: 2.1 - 2.1.3 Vendor URL: http://geronimo.apache.org/ Bug: Directory Traversal File Upload Exploits: YES Reported: 10.12.2008 Vendor...

Apache Geronimo 2.1.x /console/portal/ URI XSS

No description provided by source. source: http://www.securityfocus.com/bid/34562/info Apache Geronimo Application Server is prone to multiple remote vulnerabilities: - Multiple directory-traversal vulnerabilities - A cross-site scripting vulnerability - Multiple HTML-injection vulnerabilities - ...

[SECURITY] CVE-2013-1777: Apache Geronimo 3 RMI classloader exposure

CVE-2013-1777: Apache Geronimo 3 RMI classloader exposure Severity: Important Vendor: The Apache Software Foundation Version Affected: Apache Geronimo 3.0 Apache Geronimo 3.0 Beta 1 Apache Geronimo 3.0 M1 Description: A misconfigured RMI classloader in Apache Geronimo 3.0 may enable an attacker t...

CVE-2013-1777

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server WAS Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to...

Code injection

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server WAS Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to...

CVE-2013-1777

The CVE-2013-1777 issue is concrete: Apache Geronimo 3.x (notably in WebSphere Application Server Community Edition 3.0.0.3) exposes an RMI classloader misconfiguration that allows remote attackers to execute arbitrary code by sending a crafted serialized object through JMX. The root cause is imp...

CVE-2013-1777

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server WAS Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to...

PHP Hash Table Collision - Denial of Service (PoC)

!/usr/bin/env python """ This script was written by Christian Mehlmauer https://twitter.com/!/FireFart Sourcecode online at: https://github.com/FireFart/HashCollision-DOS-POC Original PHP Payloadgenerator taken from https://github.com/koto/blog-kotowicz-net-examples/tree/master/hashcollision...