servlets.com XSS vulnerability

Open Bug Bounty ID: OBB-424017 Description| Value ---|--- Affected Website:| servlets.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Shee...

McAfee ePolicy Orchestrator DataChannel Blind SQL Injection Vulnerability(CVE-2016-8027)

Summary An exploitable blind sql injection vulnerability exists within McAfee's ePolicy Orchestrator 5.3.0 that is accessible without authentication. A specially crafted HTTP post can allow an aggressor to alter a sql query which can result in disclosure of information within the database or...

Apache Sling Servlets Post 2.3.20 Cross Site Scripting Vulnerability

Exploit for multiple platform in category remote exploits CVE-2017-9802: Apache Sling XSS vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Sling Servlets Post 2.3.20 Description: The Javascript method Sling.evalString uses the javascript eval...

Apache Sling Servlets Post Cross-Site Scripting Vulnerability

Apache Sling API is the United States Apache Apache Software Foundation's set of frameworks for building Web applications. Apache Sling Servlets Post is one of the container. A security vulnerability exists in the Javascript method Sling.evalString in Apache Sling Servlets Post versions prior to...

CVE-2017-9802

The Javascript method Sling.evalString in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings...

CVE-2017-9802

CVE-2017-9802 affects Apache Sling Servlets Post prior to version 2.3.22. The vulnerability arises from using the Javascript function eval on input strings in Sling.evalString(), enabling cross-site scripting (XSS). Impact is XSS through crafted input strings; affected version is 2.3.20 (and olde...

PT-2017-19195

Name of the Vulnerable Software and Affected Versions Apache Sling Servlets Post versions prior to 2.3.22 Description The issue concerns the Javascript method Sling.evalString which uses the javascript eval function to parse input strings. This allows for XSS attacks by passing specially crafted...

CVE-2017-9802: Improper Neutralization of Input During Web Page Generation

The Javascript method Sling.evalString in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings...

CVE-2015-2560

Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet...

CVE-2015-2560: Undefined Security Weakness

Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet...

PT-2017-6600

Name of the Vulnerable Software and Affected Versions Manage Engine Desktop Central version 9 before build 90135 Description The issue allows remote attackers to change passwords of users with the Administrator role. This is achieved via an addOrModifyUser operation to the...

CVE-2017-11466

Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fieldName parameter to servlets/ajaxfileupload. This results...

PT-2017-12033

Name of the Vulnerable Software and Affected Versions dotCMS version 4.1.1 Description The issue allows remote authenticated administrators to upload arbitrary files, including .jsp files, to any location on the server. This is achieved through directory traversal sequences in the fieldName...

EUVD-2022-4402

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the origin...

Code injection

Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not...

HPE Operations Orchestration Insecure Deserialization (CVE-2016-8519)

An insecure deserialization vulnerability has been reported in HPE Operations Orchestration. The vulnerability is due to the deserialization of untrusted data in several servlets used for backwards compatibility with older API versions. A remote, unauthenticated attacker can exploit this...

CVE-2016-6600

The CVE refers to a directory traversal vulnerability in WebNMS Framework Server 5.2 and 5.2 SP1 (ZOHO WebNMS) via FileUploadServlet, where a crafted fileName with .. allows remote attackers to upload and execute JSP files. A Metasploit module and multiple advisories document an arbitrary file up...

PT-2017-8998

Name of the Vulnerable Software and Affected Versions ZOHO WebNMS Framework versions 5.2 through 5.2 SP1 Description A directory traversal issue exists in the file upload functionality, allowing remote attackers to upload and execute arbitrary JSP files. This is achieved by including a .. dot dot...

PT-2017-8999

Name of the Vulnerable Software and Affected Versions ZOHO WebNMS Framework versions 5.2 through 5.2 SP1 Description A directory traversal issue exists in the file download functionality, allowing remote attackers to read arbitrary files. This is achieved by including a .. dot dot in the fileName...

Updated struts packages fix security vulnerabilities

Updated struts packages fix security vulnerabilities: A vulnerability in Apache Struts 1 ActionForm allowing unintended remote operations against components on server memory, such as Servlets and ClassLoader, was found CVE-2016-1181. It was reported that The Apache Struts 1 Validator contains a...