tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

tomcat: security manager bypass via JSP Servlet config parameters

It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

tomcat: security manager bypass via JSP Servlet config parameters

It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

tomcat: security manager bypass via IntrospectHelper utility function

It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications...

tomcat: system property disclosure

It was discovered that when a SecurityManager was configured, Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible...

Unauthorized Access Via REST API

spark-core is vulnerable to unauthorized access via the REST API. The vulnerability exists as the REST API endpoint does not perform authorization checks based on the UI root's security manager. This allows all users to view all applications through the REST API, even if they could normally not...

F5 Networks BIG-IP : Apache Tomcat 6.x vulnerability (K30971148)

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web...

CVE-2017-5169

An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identified. The flaws exist within the Redis and Apache Felix Gogo servers that are installed as part of this product. By issuing specific HTTP Po...

CVE-2017-5169

An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identified. The flaws exist within the Redis and Apache Felix Gogo servers that are installed as part of this product. By issuing specific HTTP Po...

CVE-2017-5168

An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests, if a user visits a...

CVE-2017-5168

An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests, if a user visits a...

Path traversal

An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests, if a user visits a...

CVE-2017-5168

An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests, if a user visits a...

CVE-2017-5168

CVE-2017-5168 affects Hanwha Techwin Smart Security Manager (SSM) versions 1.5 and prior (also 1.4 and prior to 1.31). The issue is multiple path traversal flaws in the ActiveMQ Broker service bundled with SSM, where crafted HTTP requests from a malicious page can lead to arbitrary file access on...

CVE-2017-5169

An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identified. The flaws exist within the Redis and Apache Felix Gogo servers that are installed as part of this product. By issuing specific HTTP Po...

CVE-2017-5169

CVE-2017-5169 affects Hanwha Techwin Smart Security Manager, versions 1.5 and earlier. The vulnerability is a Cross-Site Request Forgery in the Redis and Apache Felix Gogo servers installed with the product, enabling an attacker to issue specific HTTP POSTs that can gain system‑level access and l...

Hanwha Techwin Smart Security Manager Elevation of Privilege Vulnerability

Hanwha Techwin Smart Security Manager is the software management platform. Hanwha Techwin Smart Security Manager has an elevation of privilege vulnerability in the ActiveMQ Broker service that could allow an attacker to access arbitrary files on the server...

Hanwha Techwin Smart Security Manager Cross-Site Request Forgery Vulnerability

Hanwha Techwin Smart Security Manager is the software management platform. Hanwha Techwin Smart Security Manager has a cross-site request forgery vulnerability in an installed Redis/Apache Felix Gogo server that can be exploited by an attacker to access a remote shell session...

Hanwha Techwin Smart Security Manager

CVSS v3 7.5 ATTENTION: Remotely exploitable Vendor: Hanwha Techwin Equipment: Smart Security Manager Vulnerabilities: Remote Code Execution AFFECTED PRODUCTS The following Smart Security Manager, a software management platform, versions are affected: Smart Security Manager Versions 1.5 and prior...

Ubuntu 14.04 LTS : Tomcat regression (USN-3177-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3177-2 advisory. USN-3177-1 fixed vulnerabilities in Tomcat. The update introduced a regression in environments where Tomcat is started with a security manager. This update fixes...