CVE-2008-2462

Cross-site scripting XSS vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

Resin viewfile Servlet file Parameter XSS

The remote host is running Resin, an application server. The 'viewfile' Servlet included with the version of Resin installed on the remote host fails to sanitize user input to the 'file' parameter before including it in dynamic HTML output. An attacker may be able to leverage this issue to inject...

Caucho Resin vulnerable to XSS via "file" parameter to "viewfile"

Overview The "viewfile" command provided by Caucho Resin contains a cross-site scripting XSS vulnerability in the "file" parameter. Description Caucho Resin is a Java-based application server. The "viewfile" command that is provided with the Resin documentation is vulnerable to XSS via the "file"...

Some users' logins are not remembered using Tomcat

When using Confluence, and Tomcat 5.5.26 or Tomcat 6 some users may find that their logins are not remembered. This is because of a bug in Tomcat's cookie handling. This is logged against the Atlassian Seraph library used by Confluence as SER-117. SER-117 has been fixed, so we "just" need to use ...

Authenticating security providers fails due to ClassLoader bugs

If the Trusted Application feature is not working and the following is seen noformat WARN atlassian.seraph.filter.TrustedApplicationsFilter Failed to login trusted application: confluence1234567 due to: com.atlassian.security.auth.trustedapps.InvalidCertificateException:...

CVE-2003-1513

Multiple cross-site scripting XSS vulnerabilities in example scripts in Caucho Technology Resin 2.0 through 2.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 env.jsp, 2 form.jsp, 3 session.jsp, 4 the move parameter to tictactoe.jsp, or the 5 name or 6 comment fields to...

CVE-2003-1513

CVE-2003-1513 concerns multiple XSS vulnerabilities in Caucho Technology Resin 2.0–2.1.2, exposed via example scripts (env.jsp, form.jsp, session.jsp, tictactoe.jsp with the move parameter, and guestbook.jsp with name/comment fields). The root cause is the failure to properly sanitize user-suppli...

Design/Logic Flaw

Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to obtain the system path via certain URLs associated with 1 deploying web applications or 2 displaying .xtp files...

Code injection

Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to cause a denial of service device hang and read data from a COM or LPT device via a DOS device name with an arbitrary extension...

Directory traversal

Directory traversal vulnerability in Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to read certain files via a .. dot dot in a URI containing a "\web-inf" sequence...

CVE-2007-2439

Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to cause a denial of service device hang and read data from a COM or LPT device via a DOS device name with an arbitrary extension...

CVE-2007-2441

Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to obtain the system path via certain URLs associated with 1 deploying web applications or 2 displaying .xtp files...

CVE-2007-2440

Directory traversal vulnerability in Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to read certain files via a .. dot dot in a URI containing a "\web-inf" sequence...

CVE-2007-2441

CVE-2007-2441 affects Caucho Resin Professional 3.1.0 and earlier for Windows. The vulnerability allows remote attackers to obtain the system path via specific URLs related to deploying web applications or displaying .xtp files, i.e., a path-disclosure/vector issue in Resin 3.1.x. The connected s...

CVE-2007-2439

Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to cause a denial of service device hang and read data from a COM or LPT device via a DOS device name with an arbitrary extension...

CVE-2007-2439

CVE-2007-2439 affects Caucho Resin Professional 3.1.0 and Resin 3.1.0 and earlier for Windows. The issue allows remote attackers to cause a denial of service (device hang) and read data from a COM or LPT device by using a DOS device name with an arbitrary extension. This is classified with a high...

EUVD-2007-2435

Directory traversal vulnerability in Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to read certain files via a .. dot dot in a URI containing a "\web-inf" sequence...

CVE-2007-2441

Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to obtain the system path via certain URLs associated with 1 deploying web applications or 2 displaying .xtp files...

CVE-2007-2440

Directory traversal vulnerability in Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to read certain files via a .. dot dot in a URI containing a "\web-inf" sequence...

CVE-2007-2440

CVE-2007-2440 affects Caucho Resin up to version 3.1.0 on Windows, enabling a remote attacker to read arbitrary files through a directory traversal via a URI containing a "\web-inf" sequence. Multiple sources (NVD/CVE pages and OpenVAS/Nessus entries) confirm a path traversal leading to informati...