CVE-2015-0249

The CVE-2015-0249 entry concerns Apache Roller versions 5.1 through 5.1.1. The vulnerability arises in the weblog page template, where remote authenticated users with weblog admin privileges can execute arbitrary Java code via a crafted Velocity Template Language (VTL). Root cause is the unsafe h...

CVE-2015-0249

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

Apache Roller OGNL Injection

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...

Apache Roller RCE Linux

Apache Roller RCE with Java-based template engine Velocity Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

Apache Roller 5.0.2 代码执行漏洞

No description provided by source...

Apache Roller OGNL Injection

This module exploits an OGNL injection vulnerability in Apache Roller 5.0.2. The vulnerability is due to an OGNL injection on the UIAction controller because of an insecure usage of the ActionSupport.getText method. Vulnerability Type: Remote Command Execution For the exploit source code contact...

CVE-2013-4171

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the 1 RSS and 2 Atom feed templates...

CVE-2013-4212

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subcla...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the 1 RSS and 2 Atom feed templates...

DSquare Exploit Pack: D2SEC_APACHE_ROLLER

Name| d2secapacheroller ---|--- CVE| CVE-2013-4212 Exploit Pack| D2ExploitPack Description| d2secapacheroller Notes|...

Design/Logic Flaw

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subcla...

CVE-2013-4212

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subcla...

CVE-2013-4171

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the 1 RSS and 2 Atom feed templates...

CVE-2013-4171

Apache Roller is affected by multiple XSS vulnerabilities in the search results templates for RSS/Atom feeds, affecting versions before 5.0.2. The issue allows remote attackers to inject arbitrary scripts/HTML. A fix is available in Roller 5.0.2 (vendor patch). If exploitation details are not dis...

CVE-2013-4212: Improper Control of Generation of Code

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subcla...

CVE-2013-4171: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the 1 RSS and 2 Atom feed templates...

Apache Roller - OGNL Injection (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Apache Roller OGNL Injection', 'Description' = %q This module exploits an OGNL injection vulnerability in Apache Roller 'Unknown', Fr...

Apache Roller OGNL Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Apache Roller OGNL Injection', 'Description' = %q This module exploits an OGNL injection vulnerability in Apache Roller 'Unknown', Fr...

Apache Roller OGNL Injection Vulnerability

This Metasploit module exploits an OGNL injection vulnerability in Apache Roller 'Apache Roller OGNL Injection', 'Description' = %q This module exploits an OGNL injection vulnerability in Apache Roller 'Unknown', From coverity.com / Vulnerability discovery 'juan vazquez' Metasploit module ,...

Apache Roller OGNL Injection

This module exploits an OGNL injection vulnerability in Apache Roller use exploit/multi/http/apache/rollerognlinjection msf undefinedrollerognlinjection show actions ...actions... msf undefinedrollerognlinjection set ACTION msf undefinedrollerognlinjection show options ...show and set options...