Apache Roller RCE Linux

Apache Roller RCE with Java-based template engine Velocity Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Apache Roller 5.0.2 代码执行漏洞

No description provided by source...

Apache Roller OGNL Injection Remote Code Execution (CVE-2013-4212)

A command execution vulnerability exists in Apache Roller due to a lack of sanitization on OGNL expressions passed to certain methods. This can lead to OGNL injection which can result in remote code execution. A remote unauthenticated attacker could exploit this vulnerability by sending crafted...

Apache Roller OGNL Injection

This module exploits an OGNL injection vulnerability in Apache Roller 5.0.2. The vulnerability is due to an OGNL injection on the UIAction controller because of an insecure usage of the ActionSupport.getText method. Vulnerability Type: Remote Command Execution For the exploit source code contact...

CVE-2013-4212

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subcla...

CVE-2013-4171

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the 1 RSS and 2 Atom feed templates...

DSquare Exploit Pack: D2SEC_APACHE_ROLLER

Name| d2secapacheroller ---|--- CVE| CVE-2013-4212 Exploit Pack| D2ExploitPack Description| d2secapacheroller Notes|...

Design/Logic Flaw

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subcla...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the 1 RSS and 2 Atom feed templates...

CVE-2013-4171

Apache Roller is affected by multiple XSS vulnerabilities in the search results templates for RSS/Atom feeds, affecting versions before 5.0.2. The issue allows remote attackers to inject arbitrary scripts/HTML. A fix is available in Roller 5.0.2 (vendor patch). If exploitation details are not dis...

CVE-2013-4212

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subcla...

CVE-2013-4212

Apache Roller

CVE-2013-4171

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the 1 RSS and 2 Atom feed templates...

CVE-2013-4212: Improper Control of Generation of Code

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subcla...

PT-2013-4883

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 5.0.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are related to...

PT-2013-4901

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 5.0.2 Description The issue allows remote attackers to execute arbitrary OGNL expressions via certain parameters, such as the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol. This is...

CVE-2013-4171: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the 1 RSS and 2 Atom feed templates...

Apache Roller - OGNL Injection (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Apache Roller OGNL Injection', 'Description' = %q This module exploits an OGNL injection vulnerability in Apache Roller 'Unknown', Fr...

Apache Roller OGNL Injection Vulnerability

This Metasploit module exploits an OGNL injection vulnerability in Apache Roller 'Apache Roller OGNL Injection', 'Description' = %q This module exploits an OGNL injection vulnerability in Apache Roller 'Unknown', From coverity.com / Vulnerability discovery 'juan vazquez' Metasploit module ,...

Apache Roller OGNL Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Apache Roller OGNL Injection', 'Description' = %q This module exploits an OGNL injection vulnerability in Apache Roller 'Unknown', Fr...