Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended...

GHSA-6QR6-X7JM-X2Q6 Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web...

GHSA-CCMR-QJ26-845G Improper Restriction of XML External Entity Reference in Elasticsearch

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content ...

Improper Restriction of XML External Entity Reference in Elasticsearch

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content ...

GHSA-3VX3-XF6Q-R5XP Exposure of Resource to Wrong Sphere in Apache Tomcat

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was...

Apache Geode vulnerable to Incorrect Authorization

When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privileg...

GHSA-JMG4-X4VP-6C6X Apache Geode vulnerable to Incorrect Authorization

When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privileg...

Improper Restriction of XML External Entity Reference in Apace Derby

XML external entity XXE vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service resource consumption via vectors involving XmlVTI and the XML dataty...

GHSA-2RVF-329F-P99G System Property Disclosure in Apache Tomcat

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for...

GHSA-4V3G-G84W-HV7R Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

CVE-2022-26890

On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Sessi...

CVE-2022-26890

On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Sessi...

The vulnerability in the web interface of the software tool for creating reports for Cisco Security Manager’s deployed security solutions allows a perpetrator to perform cross-site scripting attacks.

The vulnerability in the web interface for managing software tools used to create reports for Cisco Security Manager’s deployed security solutions exists due to the lack of protective measures taken for the web page structure. Exploiting this vulnerability allows a malicious actor to perform...

GHSA-QGRQ-CX4C-2RMM Incorrect Authorization in WildFly Elytron

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secur...

Incorrect Authorization in WildFly Elytron

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secur...

The vulnerability in the web interface of the software tool for creating reports for Cisco Security Manager’s deployed security solutions allows a perpetrator to perform cross-site scripting attacks.

The vulnerability in the web interface for creating reports for Cisco Security Manager’s deployed security solutions is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using the specially...

The vulnerability in the web interface of the software tool for creating reports for Cisco Security Manager’s deployed security solutions allows a perpetrator to perform cross-site scripting attacks.

The vulnerability in the web interface for creating reports for Cisco Security Manager’s deployed security solutions is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using the specially...

The vulnerability in the web interface of the software tool for creating reports for Cisco Security Manager’s deployed security solutions allows a perpetrator to perform cross-site scripting attacks.

The vulnerability in the web interface for creating reports for Cisco Security Manager’s deployed security solutions is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using the specially...

The vulnerability in the web interface of the software tool for creating reports for Cisco Security Manager’s deployed security solutions allows a perpetrator to perform cross-site scripting attacks.

The vulnerability in the web interface for creating reports for Cisco Security Manager’s deployed security solutions is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using the specially...

The vulnerability in the web interface of the software tool for creating reports for Cisco Security Manager’s deployed security solutions allows a perpetrator to perform cross-site scripting attacks.

The vulnerability in the web interface for creating reports for Cisco Security Manager’s deployed security solutions is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using the specially...