PT-2020-10356

Name of the Vulnerable Software and Affected Versions Determine Contract Lifecycle Management CLM version 5.4 Description An issue in report edit.jsp allows any authenticated user to execute Groovy code when generating a report. This results in arbitrary code execution on the underlying server...

PT-2020-10354

Name of the Vulnerable Software and Affected Versions Determine Contract Lifecycle Management CLM version 5.4 Description An issue was discovered that allows authenticated remote attackers to read arbitrary files, including configuration files containing administrative credentials, due to an XML...

PT-2020-10355

Name of the Vulnerable Software and Affected Versions Determine Contract Lifecycle Management CLM version 5.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML through multiple getchart.jsp parameters. Recommendations For version 5.4, avoi...

CVE-2019-20155: Improper Control of Generation of Code

An issue was discovered in reportedit.jsp in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server...

Determine Contract Lifecycle Management XML External Entity Injection Vulnerability

Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. An XML external entity injection vulnerability exists in the definitionuploadattach.jsp file in Determine CLM version 5.4, which can be exploited by an attacker...

CVE-2019-20154: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM v5.4. A cross-site scripting XSS vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitrary web script or HTML...

CVE-2019-20153: Improper Restriction of XML External Entity Reference

An issue was discovered in Determine formerly Selectica Contract Lifecycle Management CLM in v5.4. An XML external entity XXE vulnerability in the upload definition feature in definitionuploadattach.jsp allows authenticated remote attackers to read arbitrary files including configuration files...

Determine Contract Lifecycle Management Input Validation Error Vulnerability

Determine Contract Lifecycle Management CLM is a suite of enterprise contract lifecycle management solutions from Determine Corporation. An input validation error vulnerability in the reportedit.jsp file in Determine CLM v5.4 can be exploited by an attacker to execute arbitrary code on this...

Apache Tomcat 8.5.0 < 8.5.49 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.5.49. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.49security-8 advisory. - When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote...

Insufficiently Protected Credentials in Apache Tomcat

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user...

GHSA-HH3J-X4MC-G48R Insufficiently Protected Credentials in Apache Tomcat

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user...

CVE-2019-12418

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user...

Design/Logic Flaw

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user...

UBUNTU-CVE-2019-12418

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user...

CVE-2019-12418

CVE-2019-12418 affects Apache Tomcat 9.0.0.M1–9.0.28, 8.5.0–8.5.47, 7.0.0–7.0.97 when JMX Remote Lifecycle Listener is enabled: a local attacker without Tomcat access can manipulate the RMI registry to perform a MITM and steal credentials to gain full control of the Tomcat instance. Connected adv...

CVE-2019-12418

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user...

Privilege Escalation

Tomcat-catalina is vulnerable to privilege escalation. When JMX Remote Lifecycle Listener is used to configure Tomcat, a local attack is possible to access Tomcat process or configuration files and manipulate RMI registry, thereby allowing the attacker to act as man-in-the-middle MitM to steal th...

Dell RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance Authorization Issues Vulnerabilities

Dell RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance are a suite of authentication and lifecycle management solutions from Dell, USA. An authorization issue vulnerability exists in Dell RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance versions...

CVE-2019-12418: Undefined Security Weakness

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user...

Dell RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance Cross-Site Scripting Vulnerabilities (CNVD-2020-03161)

Dell RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance are a suite of authentication and lifecycle management solutions from Dell, USA. A cross-site scripting vulnerability exists in Dell RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance versions...