PT-2014-4924

Name of the Vulnerable Software and Affected Versions Pivotal Grails versions 2.0.0 through 2.3.6 Resources plugin versions 1.0.0 through 1.2.5 Description The default configuration of the Resources plugin for Pivotal Grails does not properly restrict access to files in the META-INF directory. Th...

CVE-2014-0053: Undefined Security Weakness

The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this identifier has been SPLIT...

CVE-2014-2857: Undefined Security Weakness

The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict access to files in the META-INF directory, which allows remote attackers to obtain sensitive information via a direct request. NOTE: this issue was SPLIT from...

Grails resources plug-in WEB-INF / META-INF File Disclosure

The remote web server uses a version of Grails, an open source web application framework for JVM, that is affected by an information disclosure vulnerability. Specifically, its 'resources' plug-in fails to restrict access to resources located under an application's 'WEB-INF' and 'META-INF'...

j2ee external parameters of the reference implementation, The steering functions caused by the security Directory Access bypass security issue-vulnerability warning-the black bar safety net

j2ee external parameter references a URL for steering forward function to cause the security Directory Access bypass security issues with! //Recently issued a vulnerability, let me produce one doubts. Today just to achieve a bit of URL jump, find the problem cause is actually very simple. First...

Default application files available for download via the application server.

see: https://jira.atlassian.com/browse/JRA-31187 e.g. https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/ and https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/web.xml . FishEye shouldn't write any user data to the WEB-INF directory. The only files which are viewable there, should be the sam...

CVE-2012-4054

Buffer overflow in the readfile function in CPE17 Autorun Killer 1.7.1 and earlier allows physically proximate attackers to execute arbitrary code via a crafted inf file...

Buffer overflow

Buffer overflow in the readfile function in CPE17 Autorun Killer 1.7.1 and earlier allows physically proximate attackers to execute arbitrary code via a crafted inf file...

CVE-2012-4054

CVE-2012-4054 affects CPE17 Autorun Killer 1.7.1 and earlier. The vulnerability is a buffer overflow in the readfile function that enables arbitrary code execution by a crafted inf file, with a Local attack vector and no authentication required per the CVSS data. Impact is listed as complete conf...

CVE-2012-4054: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the readfile function in CPE17 Autorun Killer 1.7.1 and earlier allows physically proximate attackers to execute arbitrary code via a crafted inf file...

tomcat request dispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

NullPointerException when Switching between Projects or Boards

In my case, the WEB-INF/classes/log4j.properties included has these loggers turned off, but they still seem to run. I am including a patch that ignores the NullPointerException following the pattern of ignoring the ClassNotFoundException. Details below taken from:...

tomcat request dispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

Hack stunt invasion site automatic installation of back door analysis-vulnerability warning-the black bar safety net

autorun. inf 2. shell. bat 3.hao.exeself-extracting file Idea: put all in C drive. When broiler master double-click the C drive to run automatically when the first file. The first file drive run the second file. While the second run of the third You run can be normal into the C drive. Will not...

tomcat request dispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

tomcat request dispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

webshell mention the weight point directory summary-vulnerability warning-the black bar safety net

C:\Documents and Settings\All Users\Start Menu\Programs\ --'look here, can jump, and we from here can get a lot of useful information such as Serv-U path. C:\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ --‘see if you can jump to this directory, if the line that is the...

tomcat request dispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

tomcat request dispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

tomcat request dispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...