CVE-2009-5046

CVE-2009-5046 affects Jetty (JSP Dump and Session Dump Servlets) with XSS due to improper validation in the JSP Dump and Session Dump Servlets, observed in Jetty versions before 6.1.22. The vulnerability enables cross-site scripting that can steal cookie-based credentials when a page using the af...

CVE-2009-5049

WebApp JSP Snoop page XSS in jetty though 6.1.21...

Code injection

WebApp JSP Snoop page XSS in jetty though 6.1.21...

CVE-2009-5049

WebApp JSP Snoop page XSS in jetty though 6.1.21...

CVE-2009-5049

CVE-2009-5049 affects Jetty, specifically the WebApp JSP Snoop page in Jetty 6.1.21. The vulnerability arises from improper validation of user-supplied input in the WebApp JSP Snoop page, enabling cross-site scripting (XSS). The connected sources consistently describe a WebApp JSP Snoop page XSS ...

WiKID Systems 2FA Enterprise Server SQL Injection Vulnerability

WiKID Systems 2FA Enterprise Server is a two-factor authentication server from WiKID Systems, USA. A SQL injection vulnerability exists in the processPref.jsp file in WiKID 2FA Enterprise Server 4.2.0-b2053 and prior versions. The vulnerability stems from a database-based application that lacks...

CVE-2019-17117

A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows an authenticated user to execute arbitrary SQL commands via the processPref.jsp key parameter...

CVE-2019-17352

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions...

CVE-2019-0352

In SAP BusinessObjects BI Platform (pre-4.1/4.2/4.3), dynamic pages (e.g., JSP) are cached, enabling an attacker to view cached, sensitive information and access dynamic pages even after logout. The available sources describe this as an information-disclosure issue but do not provide remediation ...

Atlassian Jira Open Redirect Vulnerability (CNVD-2019-30065)

Jira is a tool developed by Australian company Atlassian for defect tracking, issue tracking and project management. An open redirect vulnerability exists in the startup.jsp resource in Jira. A remote attacker could exploit this vulnerability to redirect users to a different website, which could ...

CVE-2019-15104

An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious...

[SECURITY] [DLA 1883-1] tomcat8 security update

Package : tomcat8 Version : 8.0.14-1+deb8u15 CVE ID : CVE-2016-5388 CVE-2018-8014 CVE-2019-0221 Debian Bug : 929895 898935 Several minor issues have been fixed in tomcat8, a Java Servlet and JSP engine. CVE-2016-5388 Apache Tomcat, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18...

NewStart CGSL MAIN 4.05 : tomcat6 Multiple Vulnerabilities (NS-SA-2019-0117)

The remote NewStart CGSL host, running version MAIN 4.05, has tomcat6 packages installed that are affected by multiple vulnerabilities: - It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also...

CVE-2019-10267

An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the...

CVE-2019-10267

An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the...

Cisco Prime Infrastructure Health Monitor - TarArchive Directory Traversal (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability', 'Description' = %q This module exploits a vulnerability...

Security Bulletin: IBM InfoSphere Information Server is affected by an Information Disclosure vulnerability

Summary An Information Disclosure vulnerability was addressed by IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2018-1917 DESCRIPTION: IBM InfoSphere Information Server could allow an authenticated user to access jsp files and disclose sensitive information. CVSS Base Score:...

CVE-2019-0305

The CVE-2019-0305 entry describes a Clickjacking vulnerability in SAP NetWeaver Process Integration JSPs (SAP_XIESR and SAP_XITOOL versions 7.10–7.11, 7.20, 7.30, 7.31, 7.40, 7.50) where frame UI restrictions are insufficient or incorrect, allowing UI elements from other domains to be overlaid. T...

Liferay Portal 7.1 CE GA4 Cross Site Scripting

Exploit Title: Liferay Portal ” / or ” /. A customized Liferay portlet which directly calls the Simple Captcha API without sanitizing the input could be susceptible to this vulnerability. Poc In a sample scenario of custom code calling the ” / JSP taglib, appending a payload like the following to...

Liferay Portal 7.1 CE GA3 SimpleCaptcha API - Cross-Site Scripting

Liferay Portal 7.1 CE GA3 SimpleCaptcha API - Cross-Site Scripting Exploit Title: Liferay Portal ” / or ” /. A customized Liferay portlet which directly calls the Simple Captcha API without sanitizing the input could be susceptible to this vulnerability. Poc In a sample scenario of custom code...