SUSE-SU-2015:1281-1 Security update for tomcat

This update fixes the following security issue: - CVE-2014-7810: Security manager bypass via EL expression bnc931442...

FreeBSD : tomcat -- multiple vulnerabilities (25e0593d-13c0-11e5-9afb-3c970e169bc2)

Apache Software Foundation reports : Low: Denial of Service CVE-2014-0230 When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be...

The vulnerability of the Samsung Security Manager video surveillance system allows a intruder to execute arbitrary code.

The vulnerability of the Samsung Security Manager video surveillance system allows a malicious actor to execute arbitrary code by uploading a specially crafted file via the HTTP protocol...

UBUNTU-CVE-2014-7810

The Expression Language EL implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanis...

Debian DLA-232-1 : tomcat6 security update

The following vulnerabilities were found in Apache Tomcat 6 : CVE-2014-0227 The Tomcat security team identified that it was possible to conduct HTTP request smuggling attacks or cause a DoS by streaming malformed data. CVE-2014-0230 AntBean@secdig, from the Baidu Security Team, disclosed that it...

[SECURITY] [DLA 232-1] tomcat6 security update

Package : tomcat6 Version : 6.0.41-2+squeeze7 CVE ID : CVE-2014-0227 CVE-2014-0230 CVE-2014-7810 Debian Bug : 787010 785312 785316 The following vulnerabilities were found in Apache Tomcat 6: CVE-2014-0227 The Tomcat security team identified that it was possible to conduct HTTP request smuggling...

DLA-232-1 tomcat6 - security update

Bulletin has no description...

Cisco Security Manager WEB Interface Cross-Site Scripting Vulnerability

Cisco Security Manager is enterprise-level management software for Cisco security products. A cross-site scripting vulnerability exists in the Cisco Security Manager WEB interface, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used ...

Apache Tomcat Security Manager Bypass Vulnerability

Apache Tomcat is a popular open source JSP application server program. Apache Tomcat versions 8.0.0-RC1 through 8.0.15, 7.0.0 through 7.0.57, and 6.0.0 through 6.0.43 have a Security Restriction Bypass vulnerability in the implementation by evaluating expressions in privileged code areas. An...

[SECURITY] CVE-2014-7810: Apache Tomcat Security Manager Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CVE-2014-7810 Security Manager Bypass Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.15 - - Apache Tomcat 7.0.0 to 7.0.57 - - Apache Tomcat 6.0.0 to 6.0.43 Description: Malicious web...

CVE-2015-0727

Cross-site scripting XSS vulnerability in the HTTP module in Cisco Security Manager CSM 4.70SP11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789...

Cross site scripting

Cross-site scripting XSS vulnerability in the HTTP module in Cisco Security Manager CSM 4.70SP11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789...

CVE-2015-0727

CVE-2015-0727 is an XSS vulnerability in the HTTP module of Cisco Security Manager (CSM) 4.7(0)SP1(1). The root cause is insufficient validation of user-supplied input in the vulnerable web interface, enabling remote attackers to inject arbitrary script or HTML via a crafted URL (Bug CSCut27789)....

CVE-2015-0727

Cross-site scripting XSS vulnerability in the HTTP module in Cisco Security Manager CSM 4.70SP11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789...

6: JSM policy not respected by deployed applications

It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to...

jboss-as-server: Unchecked access to MSC Service Registry under JSM

In Red Hat JBoss Enterprise Application Platform, when running under a security manager, it was possible for deployed code to get access to the Modular Service Container MSC service registry without any permission checks. This could allow malicious deployments to modify the internal state of the...

Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

Cisco Security Manager Cross-Site Scripting Vulnerability

A vulnerability in the HTTP module of the Cisco Security Manager CSM could allow an unauthenticated, remote attacker to conduct reflective cross-site scripting attacks. The vulnerability is due to insufficient validation of user-supplied input submitted to the vulnerable CSM web interface. An...

Fixed in Apache Tomcat 6.0.44

Low: Denial of Service CVE-2014-0230 When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the...

tomcat -- multiple vulnerabilities

Apache Software Foundation reports: Low: Denial of Service CVE-2014-0230 When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be...