tomcat -- bypass of security constraints

The Apache Software Foundation reports: When using FORM authentication it was possible to bypass the security constraint checks in the FORM authenticator by appending "/jsecuritycheck" to the end of the URL if some other component such as the Single-Sign-On valve had called request.setUserPrincip...

Stable Update for Chrome OS

The Stable channel has been updated to 23.0.1271.94 Platform version: 2913.224.0 for all Chrome OS Devices. This build contains a number of new features, bug fixes and security improvements. Machines will be receiving updates over the next several days. Release Highlights: Updated default apps...

Oracle OpenSSO 8.0 Multiple XSS POST Injection Vulnerabilities

Exploit for multiple platform in category web applications Oracle OpenSSO 8.0 Multiple XSS POST Injection Vulnerabilities alert1;' / alert2;' / input type="hidden" n...

Oracle OpenSSO 8.0 - Multiple Cross-Site Scripting POST Injection Vulnerabilities

Oracle OpenSSO 8.0 - Multiple Cross-Site Scripting POST Injection Vulnerabilities Oracle OpenSSO 8.0 Multiple XSS POST Injection Vulnerabilities alert1;' / alert2;' / alert3;' /...

Oracle OpenSSO 8.0 Multiple XSS POST Injection Vulnerabilities

Summary Oracle OpenSSO is a complete solution that provides Web access management, federated single sign-on and Web services security in a single, self-contained application. Description Oracle OpenSSO suffers from multiple cross-site scripting vulnerabilities when input passed via several...

CVE-2012-4513

khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service crash and possibly read memory via large canvas dimensions, which leads to an unexpected sign extension and a heap-based buffer over-read...

CVE-2012-4513

khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service crash and possibly read memory via large canvas dimensions, which leads to an unexpected sign extension and a heap-based buffer over-read...

PT-2012-4799

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.x before 6.0.36 Apache Tomcat versions 7.x before 7.0.30 Description The issue allows remote attackers to bypass security-constraint checks when FORM authentication is used. This can be achieved by leveraging a previou...

CVE-2012-3175

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-0518...

CVE-2012-3175

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-0518...

PT-2012-4537 · Oracle · Oracle Application Server Single Sign-On

Name of the Vulnerable Software and Affected Versions: Oracle Application Server Single Sign-On version 10.1.4.3.0 Description: The issue affects the integrity of the system, related to Redirects. Recommendations: For version 10.1.4.3.0, at the moment, there is no information about a newer versio...

CVE-2012-3175: Undefined Security Weakness

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-0518...

CVE-2012-3175

Technical details for CVE-2012-3175 are not publicly provided in the connected documents. The available sources mention Oracle SSO 10.1.4.3.0 and redirects generally, but no concrete exploit, affected components/versions, root cause, or fixes are described here. Monitor for updates.

Design/Logic Flaw

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175...

CVE-2012-0518

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175...

PT-2012-2633 · Oracle · Oracle Fusion Middleware +1

Name of the Vulnerable Software and Affected Versions: Oracle Fusion Middleware version 10.1.4.3.0 Description: The issue affects the integrity of the system, related to Redirects in the Oracle Application Server Single Sign-On component. Recommendations: For Oracle Fusion Middleware version...

PT-2012-4507

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite version 11.5.10.2 Description The issue affects the integrity of the system, related to Signon, both local and Single Sign-On SSO. Recommendations For Oracle E-Business Suite version 11.5.10.2, at the moment, there is n...

CVE-2012-0518: URL Redirection to Untrusted Site

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175...

"Warning Zombies Ahead!" - Road sign board Hacked

Drivers may have gotten a chuckle out of an electronic message board in Maine warning of zombies, but city officials were not amused. A Portland, Maine road sign is changed to a zombie warning on Wednesday, Oct. 10, 2012. It originally read "Night work 8 pm-6 am. Expect delays." An electronic...

CVE-2012-5352

Java Open Single Sign-On Project Home JOSSO allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."...