Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities

Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities Digital Security Research Group DSecRG Advisory DSECRG-09-018 Application: Apache Geronimo Application Server Versions Affected: 2.1 - 2.1.3 Vendor URL: http://geronimo.apache.org/ Bug: Directory Traversal File Upload Exploits:...

Apache Geronimo 2.1.x - Cross-Site Request Forgery (Multiple Admin Function)

Apache Geronimo 2.1.x - Cross-Site Request Forgery Multiple Admin Function source: https://www.securityfocus.com/bid/34562/info Apache Geronimo Application Server is prone to multiple remote vulnerabilities: - Multiple directory-traversal vulnerabilities - A cross-site scripting vulnerability -...

Apache Geronimo Cross Site Request Forgery

Original Advisory: http://dsecrg.com/pages/vul/show.php?id=120 Digital Security Research Group DSecRG Advisory DSECRG-09-020 Application: Apache Geronimo Application Server Versions Affected: 2.1 - 2.1.3 Vendor URL: http://geronimo.apache.org/ Bug: Multiple XSRF Vulnerabilities Exploits: YES...

Apache Geronimo 2.1.x - consoleportal URI Cross-Site Scripting

Apache Geronimo 2.1.x - consoleportal URI Cross-Site Scripting source: https://www.securityfocus.com/bid/34562/info Apache Geronimo Application Server is prone to multiple remote vulnerabilities: - Multiple directory-traversal vulnerabilities - A cross-site scripting vulnerability - Multiple...

Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities

Digital Security Research Group DSecRG Advisory DSECRG-09-018 Application: Apache Geronimo Application Server Versions Affected: 2.1 - 2.1.3 Vendor URL: http://geronimo.apache.org/ Bug: Directory Traversal File Upload Exploits: YES Reported: 10.12.2008 Vendor response: 10.12.2008 Solution: YES Da...

Apache Geronimo Cross Site Scripting

Original advisory http://dsecrg.com/pages/vul/show.php?id=119 Digital Security Research Group DSecRG Advisory DSECRG-09-019 Application: Apache Geronimo Application Server Versions Affected: 2.1 - 2.1.3 Vendor URL: http://geronimo.apache.org/ Bug: Multiple XSS Vulnerabilities Exploits: YES...

Apache Geronimo 2.1.x - '/console/portal/Server/Monitoring' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/34562/info Apache Geronimo Application Server is prone to multiple remote vulnerabilities: - Multiple directory-traversal vulnerabilities - A cross-site scripting vulnerability - Multiple HTML-injection vulnerabilities - A cross-site request-forgery...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

tomcat examples XSS

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer...

Design/Logic Flaw

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories...

CVE-2008-0732

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories...

CVE-2008-0732

CVE-2008-0732 concerns the init script used by Apache Geronimo on SUSE Linux. The issue arises when the script follows symlinks during a chown operation, which could allow a local attacker to obtain access to unspecified files or directories. The available connected documents confirm the vulnerab...

CVE-2008-0732

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories...

CVE-2008-0732: Improper Link Resolution Before File Access

The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories...

CVE-2007-5797: Improper Authentication

SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database...

CVE-2007-5797

SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database...

CVE-2007-5797

Apache Geronimo 2.0–2.1 is affected by CVE-2007-5797 due to a SQLLoginModule/LoginModule path that does not throw an exception for a nonexistent username. This results in remote authentication bypass, permitting a login attempt with any username not in the database to succeed. The concrete descri...

CVE-2007-5085

Unspecified vulnerability in the management EJB MEJB in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors...

CVE-2007-5085

CVE-2007-5085 affects Apache Geronimo’s management EJB (MEJB) and is exploitable before version 2.0.2. The vulnerability allows remote attackers to bypass authentication and gain access to Geronimo internals via unspecified vectors. Affected component is MEJB in Geronimo prior to 2.0.2; root caus...