CVE-2006-4954

The CVE relates to the updateuser servlet in Neon WebMail for Java prior to 5.08, which does not validate the in_id parameter. This vulnerability allows remote attackers to modify information of arbitrary users (e.g., passwords, permissions, profile settings, and creating/deleting users). The iss...

NeoSys Neon Webmail for Java 5.065.07 - updatemail Servlet Arbitrary Mail Message Manipulation

NeoSys Neon Webmail for Java 5.065.07 - updatemail Servlet Arbitrary Mail Message Manipulation...

NeoSys Neon Webmail for Java 5.065.07 - downloadfile Servlet Traversal Arbitrary File Access

NeoSys Neon Webmail for Java 5.065.07 - downloadfile Servlet Traversal Arbitrary File Access...

NeoSys Neon Webmail for Java 5.065.07 - maillist Servlet Multiple SQL Injections

NeoSys Neon Webmail for Java 5.065.07 - maillist Servlet Multiple SQL Injections source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: - an arbitrary-file-uplo...

NeoSys Neon Webmail for Java 5.065.07 - updateuser?in_name Servlet Cross-Site Scripting

NeoSys Neon Webmail for Java 5.065.07 - updateuser?inname Servlet Cross-Site Scripting...

NeoSys Neon Webmail for Java 5.06/5.07 - 'updateuser?in_name' Servlet Cross-Site Scripting

source: https://www.securityfocus.com/bid/20109/info Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include: - an arbitrary-file-upload vulnerability - an arbitrary-email-manipulation vulnerability - multiple...

Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability

No description provided by source. ScanAlert Security Advisory - http://www.scanalert.com Directory Listing in Apache Tomcat 5.x.x Date: 07/21/2006 Vendor: Apache Package: Tomcat Versions: 5.x.x 5.0.28, 5.5.12, 5.5.9, and 5.5.7 . Confirmed Credit: ScanAlert.s Enterprise Services Team. Overview:...

SOL5790 - Security Advisory: Apache JServ Protocol vulnerability - JVN#79314822

Apache Tomcat, an implementation of the Java Servlet and JavaServer Pages technologies, contains a vulnerability in processing specific requests. Information about this advisory is available at the following location:...

Resin viewfile Servlet Arbitrary File Disclosure

The remote host is running Resin, an application server. The installation of Resin on the remote host includes a servlet, named 'viewfile', that lets an unauthenticated, remote attacker view any file within the web root directory on the affected host. This could lead to a loss of confidentiality...

Directory traversal

Directory traversal vulnerability in the viewfile servlet in the documentation package resin-doc for Caucho Resin 3.0.17 and 3.0.18 allows remote attackers to read arbitrary files under other web roots via the contextpath parameter. NOTE: this issue can produce resultant path disclosure when the...

CVE-2006-2438

Directory traversal vulnerability in the viewfile servlet in the documentation package resin-doc for Caucho Resin 3.0.17 and 3.0.18 allows remote attackers to read arbitrary files under other web roots via the contextpath parameter. NOTE: this issue can produce resultant path disclosure when the...

CVE-2006-2437

The viewfile servlet in the documentation package resin-doc for Caucho Resin 3.0.17 and 3.0.18 allows remote attackers to obtain the source code for file under the web root via the file parameter...

CVE-2006-2438

Directory traversal vulnerability in the viewfile servlet in the documentation package resin-doc for Caucho Resin 3.0.17 and 3.0.18 allows remote attackers to read arbitrary files under other web roots via the contextpath parameter. NOTE: this issue can produce resultant path disclosure when the...

CVE-2006-2438

CVE-2006-2438 is a directory traversal in Resin’s viewfile servlet (resin-doc) affecting Resin 3.0.17 and 3.0.18. An unauthenticated remote attacker can read arbitrary files under other web roots via the contextpath parameter, with potential path disclosure when the parameter is invalid. The issu...

CVE-2006-2437

The CVE-2006-2437 entry concerns Caucho Resin’s viewfile servlet in the Resin documentation package (resin-doc) for versions 3.0.17 and 3.0.18. The available sources in the connected documents describe an arbitrary file disclosure: an unauthenticated remote attacker can obtain the contents of fil...

AJP Connector Detection

The remote host is running an AJP Apache JServ Protocol connector, a service by which a standalone web server such as Apache communicates over TCP with a Java servlet container such as Tomcat. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid21186; scriptversion"1.11";...

CVE-2005-4757

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, are affected by an issue where the servlet root URL pattern (/) is not properly constrained, potentially allowing remote attackers to bypass intended protections. The vulnerability is described across multiple ...

CVE-2005-4757

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, do not properly "constrain" a "/" slash servlet root URL pattern, which might allow remote attackers to bypass intended servlet protections...

CVE-2005-4760

BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier, and 7.0 SP5 and earlier, when fullyDelegatedAuthorization is enabled for a servlet, does not cause servlet deployment to fail when failures occur in authorization or role providers, which might prevent the servlet from being "fully...

CVE-2005-4760

The CVE affects BEA WebLogic Server and WebLogic Express: versions 8.1 SP3 and earlier, and 7.0 SP5 and earlier, where fullyDelegatedAuthorization is enabled for a servlet. The issue is that if authorization or the role providers fail, servlet deployment may not fail as intended, potentially leav...