CVE-2016-0714

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...

CVE-2016-0714

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...

CVE-2016-0714

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...

CVE-2016-0714

The CVE-2016-0714 entry concerns the Tomcat session-persistence mechanism. In Apache Tomcat versions affected (6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2), the session-persistence implementation mishandles session attributes, allowing remote authenticated use...

CVE-2016-0714: Undefined Security Weakness

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...

Apache Tomcat Security Manager Bypass Vulnerability - 01 (Feb 2016) - Windows

Apache Tomcat is prone to a security manager bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...

CVE-2016-0714

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...

Apache Tomcat Security Manager Remote Code Execution Vulnerability

Apache Tomcat is a popular open source JSP application server program. Apache Tomcat Security Manager suffers from a security restriction bypass vulnerability in the implementation of the session persistence mechanism that allows an attacker to place constructed objects in a session, which can be...

UBUNTU-CVE-2016-0714

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...

Fixed in Apache Tomcat 6.0.45

Low: Limited directory traversal CVE-2015-5174 This issue only affects users running untrusted web applications under a security manager. When accessing resources via the ServletContext methods getResource getResourceAsStream and getResourcePaths the paths should be limited to the current web...

PT-2016-1316

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.x before 6.0.45 Apache Tomcat versions 7.x before 7.0.68 Apache Tomcat versions 8.x before 8.0.31 Apache Tomcat versions 9.x before 9.0.0.M2 Description The issue is related to the session-persistence implementation in...

Seditio CMS 1.7.1 Password Disclosure

Exploit Title: Seditio CMS Multiple Vulnerabilities + Google Dork: intext:"Powered by Seditio CMS" + Date: 27/7/2015 + Exploit Author: Arash Khazaei + Vendor Homepage: http://www.seditiocms.com/ + Software Link: http://www.seditiocms.com/page.php?id=20&a=dl + Version: 1.7.1Last Version + Tested...

PT-2015-5011

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition version 7.7.2 Description The issue allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation, as the session is not terminated upon a logout action. Recommendations Fo...

IBM WebSphere Service Registry and Repository 8.5 < 8.5.0.1 Multiple Vulnerabilities

The version of IBM WebSphere Service Registry and Repository WSRR is version 8.5 prior to 8.5.0.1. It is therefore, affected by multiple vulnerabilities : - An unspecified DOM based cross-site scripting XSS vulnerability in the WSRR web UI. CVE-2014-6132 - WSSR web interface issues a cookie that ...

PT-2014-6130

Name of the Vulnerable Software and Affected Versions IBM Cognos Mobile versions 10.1.1 before FP3 IF1 IBM Cognos Mobile versions 10.2.0 before FP2 IF1 IBM Cognos Mobile versions 10.2.1 before FP4 IF1 Description The issue allows remote attackers to bypass intended Business Intelligence...

CVE-2012-5158

Puppet Enterprise PE before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors...

CVE-2005-1744: Incomplete Cleanup

BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role...

CVE-2003-1095

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate...

CVE-2003-1095

BEA WebLogic Server/Express 7.0 and 7.0.0.1 are affected by CVE-2003-1095 due to improper handling of memory session persistence: authentication data is not cleared on redeploy, potentially allowing re-authenticated access without re-signing in. The issue is described across multiple feeds (NVD/N...

CVE-2003-1095: Undefined Security Weakness

BEA WebLogic Server and Express 7.0 and 7.0.0.1, when using "memory" session persistence for web applications, does not clear authentication information when a web application is redeployed, which could allow users of that application to gain access without having to re-authenticate...