CVE-2016-0710

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the 1 role or 2 user parameter to services/usermanager/users/...

CVE-2016-0712

CVE-2016-0712 is a cross-site scripting (XSS) vulnerability in Apache Jetspeed, reported as exploitable via the URI path (PATH_INFO) when accessing JetSpeed portals (prior to 2.3.1). The core issue is improper validation of user-supplied input in the portal path, enabling remote attackers to inje...

CVE-2016-0711

Multiple cross-site scripting XSS vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a 1 link, 2 page, or 3 folder resource...

CVE-2016-0711

Apache Jetspeed is vulnerable to cross-site scripting via the title field when adding a link, page, or folder, due to insufficient validation of user input. A remote attacker could inject scripts into pages viewed by users, potentially executing in the browser and, per IBM advisory, may enable th...

CVE-2016-0712

Cross-site scripting XSS vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to portal...

CVE-2016-0709

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. dot dot in a ZIP archive entry, as demonstrated by...

EUVD-2016-3259

The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to 1 add, 2 edit, or 3 delete users via the REST API...

CVE-2016-0712: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to portal...

CVE-2016-2171: Undefined Security Weakness

The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to 1 add, 2 edit, or 3 delete users via the REST API...

CVE-2016-0710: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the 1 role or 2 user parameter to services/usermanager/users/...

CVE-2016-0711: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a 1 link, 2 page, or 3 folder resource...

PT-2016-5046

Name of the Vulnerable Software and Affected Versions Apache Jetspeed versions prior to 2.3.1 Description The issue concerns the User Manager service in Apache Jetspeed, which fails to properly restrict access using Jetspeed Security. This allows remote attackers to perform unauthorized actions o...

PT-2016-4383

Name of the Vulnerable Software and Affected Versions Apache Jetspeed versions prior to 2.3.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a...

PT-2016-4381

Name of the Vulnerable Software and Affected Versions Apache Jetspeed versions prior to 2.3.1 Description The issue allows remote authenticated administrators to write to arbitrary files and consequently execute arbitrary code via a .. dot dot in a ZIP archive entry. This can be achieved by...

CVE-2016-0709: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. dot dot in a ZIP archive entry, as demonstrated by...

PT-2016-4382

Name of the Vulnerable Software and Affected Versions Apache Jetspeed versions prior to 2.3.1 Description The issue concerns SQL injection vulnerabilities in the User Manager service. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerabilities can be...

PT-2016-4384

Name of the Vulnerable Software and Affected Versions Apache Jetspeed versions prior to 2.3.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to the portal. This can be achieved by manipulating the PATH INFO variable...

Apache Jetspeed Detection

Detection of Apache Jetspeed Open Portal. This script sends an HTTP GET request and tries to get the version from the response. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Apache Jetspeed Multiple Vulnerabilities (Mar 2016)

Apache Jetspeed is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:jetspeed"; if...

Apache Jetspeed - Arbitrary File Upload (Metasploit)

Exploit for java platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Jetspeed Arbitrary File Upload', 'Description' = %q This module exploits the unsecure...