GHSA-8H77-9VH5-HW5G Mortbay Jetty vulnerable to Cross-site scripting

Cross-site scripting XSS vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies...

Direct Web Remoting vulnerable to Denial of Service

Getahead Direct Web Remoting DWR before 1.1.4 allows attackers to cause a denial of service memory exhaustion and servlet outage via unknown vectors related to a large number of calls in a batch...

GHSA-HG5P-233H-C7FH Direct Web Remoting vulnerable to Denial of Service

Getahead Direct Web Remoting DWR before 1.1.4 allows attackers to cause a denial of service memory exhaustion and servlet outage via unknown vectors related to a large number of calls in a batch...

Apache Tomcat AJP Connector Information Leak

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when...

Apache Tomcat Source Code Disclosure

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

GHSA-8V5P-2CPV-C2X6 Apache Tomcat Source Code Disclosure

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

GHSA-JXCV-V856-J5VG Apache Tomcat Source Code Disclosure

The default servlet org.apache.catalina.servlets.DefaultServlet in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet...

Apache Tomcat Source Code Disclosure

The default servlet org.apache.catalina.servlets.DefaultServlet in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet...

Exploit for Path Traversal in Wso2 Api_Manager

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit and writeup...

The vulnerability of the `readRemoteInvocation` method implementation in the HTTP request handler based on the Servlet-API `HttpInvokerServiceExporter` of the Spring Framework allows a attacker to execute arbitrary code.

The vulnerability of the readRemoteInvocation method implemented by the HTTP-request handler based on the Servlet-API HttpInvokerServiceExporter in the Spring Framework software platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious...

The vulnerability of the UI Servlet component of the Oracle Configurator allows a attacker to gain access to read, modify, add, or delete data.

The vulnerability of the UI Servlet component of the Oracle Configurator relates to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain access to read, modify, add, or delete data using the HTTP protocol over the network...

The vulnerability of Jetty servlet containers, related to improper authentication, allows attackers to gain access to confidential data.

The vulnerability of Jetty servlet containers is related to improper authentication. Exploiting this vulnerability allows a malicious actor to gain access to confidential data...

Spring Framework RCE, Early Announcement

Updates 04-13 "Data Binding Rules Vulnerability CVE-2022-22968" follow-up blog post published, related to the "disallowedFields" from the Suggested Workarounds 04-08 Snyk announces an additional attack vector for Glassfish and Payara. See also related Payara, upcoming release announcement 04-04...

DWSurvey 代码问题漏洞

DWSurvey is a survey system written in Java. DWSurvey v3.2.0 has a security vulnerability that allows an attacker to write arbitrary files via the component /utils/ToHtmlServlet.java...

CVE-2021-42854

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's DSA PluginServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/plugin/pmx" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be...

Aternity SteelCentral AppInternals 路径遍历漏洞

Aternity SteelCentral AppInternals is a monitoring modern automation solution from Aternity, Inc. It provides application performance monitoring APM and diagnostics. Aternity SteelCentral AppInternals Dynamic Sampling Agent DSA A security vulnerability exists in the AgentConfigurationServlet that...

CVE-2022-24252

An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file...

CVE-2022-24252

An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file...

PT-2022-4931 · Atlassian · Crowd +6

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo versions 8.0.0 through 8.0.8 Atlassian Bamboo versions 8.1.0 through 8.1.7 Atlassian Bamboo versions 8.2.0 through 8.2.3 Atlassian Bitbucket versions 7.0.0 through 7.6.15 Atlassian Bitbucket versions 7.7.0 through 7.17.7...

PT-2022-3872 · Atlassian · Crowd +6

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo versions prior to 8.0.9 Atlassian Bamboo versions 8.1.0 through 8.1.8 Atlassian Bamboo versions 8.2.0 through 8.2.4 Atlassian Bitbucket versions prior to 7.6.16 Atlassian Bitbucket versions 7.7.0 through 7.17.8 Atlassian...