Apache Tomcat 6 / 7 / 8 / 9 Information Disclosure

Exploit Title:Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability Date: 4th March 2017 Exploit Author: justpentest Vendor Homepage: tomcat.apache.org Version: Apache Tomcat 9.0.0.M1 through 9.0.0.M11, 8.5.0 through 8.5.6, 8.0.0.RC1 through 8.0.38, 7.0.0 through 7.0.72 and 6.0.0 through 6.0....

Apache Tomcat 6/7/8/9 - Information Disclosure

Exploit Title:Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability Date: 4th March 2017 Exploit Author: justpentest Vendor Homepage: tomcat.apache.org Version: Apache Tomcat 9.0.0.M1 through 9.0.0.M11, 8.5.0 through 8.5.6, 8.0.0.RC1 through 8.0.38, 7.0.0 through 7.0.72 and 6.0.0 through 6.0....

CVE-2017-7400

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

Apache Tomcat 6/7/8/9 - Information Disclosure Vulnerability

Exploit for multiple platform in category remote exploits Exploit Title:Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability Date: 4th March 2017 Exploit Author: justpentest Vendor Homepage: tomcat.apache.org Version: Apache Tomcat 9.0.0.M1 through 9.0.0.M11, 8.5.0 through 8.5.6, 8.0.0.RC1...

Image Gallery with Slideshow <= 1.5.2 - Multiple XSS and SQL Injection

The plugin is still affected and has been closed...

CVE-2017-7363

Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...

CVE-2017-7361

Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack...

Design/Logic Flaw

Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack...

Design/Logic Flaw

Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...

Sql injection

Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack...

CVE-2017-7363

Pixie 1.0.4 is affected by a cross-site scripting (XSS) vulnerability in Pixie’s admin/index.php s=publish&m=module&x= flow. The root cause is improper validation of user-submitted input, enabling injection of arbitrary web script/HTML. Impact: potential for session hijacking or defacement as des...

CVE-2017-7360

Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack...

CVE-2017-7363

Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...

CVE-2017-7359

Pixie 1.0.4 contains a cross-site scripting (XSS) vulnerability in the CMS, described as an XSS in Pixie 1.0.4 via admin/index.php s=login&m=. Root cause: improper input validation/handling. Impact per sources indicates potential script injection; exploitation status is not provided in the docume...

Cross-site Scripting (XSS)

sentry-provider-db is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of input sanitization in the FORMATPARAM parameter. The unsanitized parameter will be displayed in the Servlet error page, causing a reflected XSS attack...

Amazon Linux AMI : tomcat6 (ALAS-2017-810)

It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP...

Google’s lessons in security: bring together security engineering and incident response

Last week during Google Next conference, we have heard an interesting talk where a google security PM, Andy Chang, explained what Google has learned from preventing, detecting and responding to cyber attacks over the years. Not surprisingly, Google is paying a lot of attention to securing the...

Medium: tomcat6

Issue Overview: It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulati...

Design/Logic Flaw

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a...

CVE-2016-6816

CVE-2016-6816 affects multiple Tomcat branches (9.0.0.M1–M11, 8.5.0–8.5.6, 8.0.0.RC1–8.0.38, 7.0.0–7.0.72, 6.0.0–6.0.47). The vulnerability arises from parsing the HTTP request line with invalid characters, which could be combined with a proxy interpreting those chars differently to inject data i...