Cross-Site Scripting (XSS)

Apache Tiles is susceptible to cross-site scripting XSS attacks. It does not limit the evaluation of Expression Language EL expressions in certain circumstances, allowing the attacker to trigger the attack via 1 tiles:putAttribute and 2 tiles:insertTemplate JSP tags...

Apache Tomcat 9.0.0.M1 < 9.0.1 Remote Code Execution via JSP Upload

The version of Apache Tomcat installed on the remote host is 9.0.0.M1 or later but prior to 9.0.1. It is, therefore, affected by an unspecified vulnerability when running with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default to false that makes it possible t...

Apache Tomcat 8.5.x < 8.5.23 Remote Code Execution via JSP Upload

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.23. It is, therefore, affected by an unspecified vulnerability when running with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default to false that makes it possible to upload a JSP...

Apache Tomcat 7.0.x < 7.0.82 Remote Code Execution via JSP Upload

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.82. It is, therefore, affected by an unspecified vulnerability when running on Windows with HTTP PUTs enabled e.g. via setting the readonly initialization parameter of the Default to false makes it possible to upload ...

Unrestricted Upload of File with Dangerous Type in mingsoft:ms-mcms

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

GHSA-C7C7-XM8G-XM36 Unrestricted Upload of File with Dangerous Type in mingsoft:ms-mcms

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

Remote Code Execution (RCE)

ms-mcms is vulnerable to a remote code execution RCE attack. The application does not verify user login statuses, allowing a malicious user to upload jsp files with .png filenames to inject and execute arbitrary JSP code...

Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal Vulnerabilities

Exploit for jsp platform in category web applications...

CVE-2018-18831

An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file in the position parameter to an arbitrary directory via a ../ Directory Traversal in the url parameter...

Design/Logic Flaw

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

CVE-2018-18830

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

CVE-2018-18660

An issue was discovered in Arcserve Unified Data Protection UDP through 6.5 Update 4. There is a DDI-VRT-2018-21 Reflected Cross-site Scripting via /authenticationendpoint/domain.jsp issue...

When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled e.g. via setting the readonly initialisation parameter of the Default to false it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it containe...

Cisco Prime Infrastructure TFTP file upload vulnerability

Added: 10/11/2018 BID: 105506 Background Cisco Prime Infrastructure, is a management system of wireless and wired networks. Problem A vulnerability in Cisco Prime Infrastructure allows remote, unauthenticated attackers to execute arbitrary commands by uploading a JSP file via TFTP, and then...

Cisco Prime Infrastructure TFTP file upload vulnerability

Added: 10/11/2018 BID: 105506 Background Cisco Prime Infrastructure, is a management system of wireless and wired networks. Problem A vulnerability in Cisco Prime Infrastructure allows remote, unauthenticated attackers to execute arbitrary commands by uploading a JSP file via TFTP, and then...

UBUNTU-CVE-2018-8006

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter...

Adobe ColdFusion CKEditor file upload

A file upload vulnerability in the CKEditor of Adobe ColdFusion 11 Update 14 and earlier, ColdFusion 2016 Update 6 and earlier, and ColdFusion 2018 July 12 release allows unauthenticated remote attackers to upload and execute JSP files through the filemanager plugin. Recent assessments: jrobles-r...

Adobe ColdFusion CKEditor unrestricted file upload

A file upload vulnerability in the CKEditor of Adobe ColdFusion 11 Update 14 and earlier, ColdFusion 2016 Update 6 and earlier, and ColdFusion 2018 July 12 release allows unauthenticated remote attackers to upload and execute JSP files through the filemanager plugin. Tested on Adobe ColdFusion...

Apache Struts v3 - Tool To Exploit 3 RCE Vulnerabilities On ApacheStruts

Script contains the fusion of 3 RCE vulnerabilities on ApacheStruts, it also has the ability to create server shells. SHELL php finished jsp process CVE ADD CVE-2013-2251 'action:', 'redirect:' and 'redirectAction' CVE-2017-5638 Content-Type CVE-2018-11776 'redirect:' and 'redirectAction' Downloa...

Debian DLA-1450-1 : tomcat8 security update

Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2018-1304 The URL pattern of '' the empty string which exactly maps to the context root was not correctly handled in Apache Tomcat when used as part of a security constraint definition. This caused the...