CVE-2011-3376

Removed by vendor...

CVE-2011-3376

org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality...

CVE-2011-3376

CVE-2011-3376 affects Apache Tomcat 7.x before 7.0.22. The issue is in DefaultInstanceManager.java, where ContainerServlets in the Manager application are not properly restricted, enabling local users to gain privileges by using an untrusted web application to access Manager functionality. Impact...

[SECURITY] CVE-2011-3376 Apache Tomcat - Privilege Escalation via Manager app

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2011-3376 Apache Tomcat - Privilege Escalation via Manager app Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.21 Description: This issue only affects environments running web applications that are n...

Apache Tomcat privilege escalation

Privilege escalation via manager app...

Apache Tomcat管理应用程序安全限制绕过漏洞

CVE ID: CVE-2011-3376 Tomcat是由Apache软件基金会下属的Jakarta项目开发的一个Servlet容器，按照Sun Microsystems提供的技术规范，实现了对Servlet和JavaServer Page（JSP）的支持，并提供了作为Web服务器的一些特有功能，如Tomcat管理和控制平台、安全域管理和Tomcat阀等。 Apache Tomcat在实现上存在安全漏洞，可疑Web应用可以访问管理应用程序，可被恶意用户利用绕过某些安全限制。要成功利用需要"manager-script"权限。 Apache Group Tomcat 7.x 厂商补丁：...

Mandriva Update for tomcat5 MDVSA-2011:156 (tomcat5)

Check for the Version of tomcat5 OpenVAS Vulnerability Test Mandriva Update for tomcat5 MDVSA-2011:156 tomcat5 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Linux Security Advisory : tomcat5 (MDVSA-2011:156)

Multiple vulnerabilities has been discovered and corrected in tomcat 5.5.x : The implementation of HTTP DIGEST authentication in tomcat was discovered to have several weaknesses CVE-2011-1184. Apache Tomcat, when the MemoryUserDatabase is used, creates log entries containing passwords upon...

Fixed in Apache Tomcat 7.0.22

Important: Information disclosure CVE-2011-3375 For performance reasons, information parsed from a request is often cached in two places: the internal request object and the internal processor object. These objects are not recycled at exactly the same time. When certain errors occur that needed t...

[SECURITY] CVE-2011-1184 Apache Tomcat - Multiple weaknesses in HTTP DIGEST authentication

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2011-1184 Apache Tomcat - Multiple weaknesses in HTTP DIGEST authentication Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.11 - - Tomcat 6.0.0 to 6.0.32 - - Tomcat 5.5.0 to 5.5.33 - - Earlier,...

CVE-2011-1184

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the...

Apache Tomcat digest authentication vulnerabilities

Multiple implementation errors make authentication vulnerable to different attacks...

Apache Tomcat 5.5.x < 5.5.34 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat 5.5.x listening on the remote host is prior to 5.5.34. It is, there, affected by multiple vulnerabilities : - Several weaknesses were found in the HTTP Digest authentication implementation. The issues are as follows:...

jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

Apache Tomcat is prone to a remote information-disclosure vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Tomcat AJP Protocol Security Bypass Vulnerability

Apache Tomcat is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"; if...

Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

Apache Tomcat is prone to a remote information-disclosure vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Tomcat java-runtime-utf-8-decoder-smuggling目录遍历漏洞

No description provided by source...

Apache Tomcat 7.0.0 < 7.0.21

The version of Tomcat installed on the remote host is prior to 7.0.21. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.21security-7 advisory. - Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5...

Fixed in Apache Tomcat 7.0.21

Important: Authentication bypass and information disclosure CVE-2011-3190 Apache Tomcat supports the AJP protocol which is used with reverse proxies to pass requests and associated data about the request from the reverse proxy to Tomcat. The AJP protocol is designed so that when a request include...