Debian DSA-3614-1 : tomcat7 - security update

The TERASOLUNA Framework Development Team discovered a denial of service vulnerability in Apache Commons FileUpload, a package to make it easy to add robust, high-performance, file upload capability to servlets and web applications. A remote attacker can take advantage of this flaw by sending fil...

Sql injection

Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor SRM Profiler formerly Storage Manager STM before 6.2.3 allow remote attackers to execute arbitrary SQL commands via the 1 ScriptSchedule parameter in the ScriptServlet servlet; the 2...

CVE-2015-7999: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

ManageEngine Desktop Central 8 / 9 < Build 91100 Multiple RCE

The ManageEngine Desktop Central application running on the remote host is version 8, or else version 9 prior to build 91100. It is, therefore, affected by multiple remote code execution vulnerabilities : - A flaw exists in the statusUpdate script due to a failure to properly sanitize user-suppli...

Apache ActiveMQ Web Console Missing X-Frame-Options Clickjacking

The version of Apache ActiveMQ running on the remote host is affected by a clickjacking vulnerability in the web-based administration console due to not setting the X-Frame-Options header in HTTP responses. A remote attacker can exploit this to trick a user into executing administrative tasks. No...

NETGEAR ProSafe Network Management System 300 Arbitrary File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'NETGEAR ProSafe Network Management System 300 Arbitrary File Upload', 'Description' = %q Netgear's ProSafe NMS300 is a network...

Adobe Experience Manager Apache Sling Servlets Post Component Information Disclosure Vulnerability

Apache Sling is an open source Web framework on the Java platform , in the JCR content library to create content-oriented applications . Adobe Experience Manager AEM is the United States of America Odobe Adobe company can be used to build websites, mobile applications and forms of content...

CVE-2016-0956

The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors...

Information disclosure

The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2016-0956

CVE-2016-0956 affects the Apache Sling Servlets Post component (version 2.3.6) used by Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0. The issue is an information-disclosure vulnerability in Sling Post 2.3.6 allowing remote attackers to obtain sensitive information via unspecified vectors. APSB...

CVE-2016-0956: Exposure of Sensitive Information to an Unauthorized Actor

The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors...

Netgear Management System Vulnerable to RCE, Path Traversal Attacks

Netgear’s ProSafe Network Management System suffers from two vulnerabilities, an arbitrary file upload and a path traversal, which could let a remote attacker execute code and download files. The problems affect the NMS300 product, a web-based system the company manufactures to help users monitor...

CVE-2015-8600: Undefined Security Weakness

The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain privileges, or have unspecified other impact via unknown vectors, aka SAP Security Note 2227855...

IBM WebSphere Application Server Sensitive Information Disclosure Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications, and is the foundation of the IBM WebSphere software platform. A security vulnerability exists in IBM WAS. A remote attacke...

Information disclosure

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors...

CVE-2015-4938

CVE-2015-4938 in IBM WebSphere Application Server could allow a remote attacker to spoof a servlet and persuade a user to enter sensitive information. Affected products/versions include WebSphere Application Server 7.0, 8.0, and 8.5.x (across Full/Li berty profiles and related bundles). The root ...

PT-2015-6728

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.x through 7.0.0.38 IBM WebSphere Application Server versions 8.0.x through 8.0.0.10 IBM WebSphere Application Server versions 8.5.x through 8.5.5.6 Description The issue allows remote attackers to...

CVE-2015-4938: Undefined Security Weakness

IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors...

CVE-2015-5176

The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource...

CVE-2015-5176

CVE-2015-5176 concerns Red Hat JBoss Portal 6.2.0: the PortletBridge PortletRequestDispatcher fails to enforce servlet security constraints, allowing a remote attacker to access resources by requesting rendering of a non-JSF resource. Root cause: improper enforcement of servlet constraints in Por...