7591 matches found
CVE-2009-2696
Apache Tomcat contains a cross-site scripting (XSS) vulnerability in the calendar example (jsp/cal/cal2.jsp). A remote attacker can inject script via the time parameter due to improper validation of user input (related to invalid HTML). The issue is documented in a GitHub advisory (GHSA-J788-FX57...
CVE-2009-2696
Cross-site scripting XSS vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter,...
Apache Tomcat 6.0 < 6.0.28 Multiple Vulnerabilities
According to its self-reported version number, the instance of Apache Tomcat 6.0 listening on the remote host is prior to 6.0.28. It is, therefore, affected by multiple vulnerabilities: - If a web app is configured to use BASIC or DIGEST authentication and the 'realm-name' attribute is not...
tomcat6 Denial-Of-Service with AJP connection
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and modjk load balancing are used, allows remote attackers to cause a denial of service application outage via a crafted request with invalid headers, related to temporary blocking of...
tomcat accept-language xss flaw
Cross-site scripting XSS vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616"...
Absolute path traversal Apache Tomcat WEBDAV
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag...
tomcat5 security update
CentOS Errata and Security Advisory CESA-2010:0580 Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS ba...
Important: Red Hat Security Advisory: tomcat5 and tomcat6 security update
Updated tomcat5 and tomcat6 packages that fix one security issue are now available for JBoss Enterprise Web Server 1.0.1 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...
tomcat: unexpected file deletion and/or alteration
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. dot dot in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry...
Important: Red Hat Security Advisory: tomcat5 security update
Updated tomcat5 packages that fix three security issues are now available for Red Hat Application Server v2. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, ar...
Important: Red Hat Security Advisory: tomcat5 security update
Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, ar...
tomcat: unexpected file deletion in work directory
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename...
tomcat: unexpected file deletion and/or alteration
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. dot dot in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry...
Apache Tomcat < 6.0.18 UTF8 Directory Traversal Vulnerability
No description provided by source. /Apache Tomcat 6.0.18 UTF8 Directory Traversal Vulnerability get /etc/passwd Exploit c0d3r: mywisdom thanks for not being lame to change exploit author tis is one of my linux w0rm module for user enumerations, i've dual os worm thanks to:...
NullPointerException when there are no cookies and AccessLogRequestInfo is enabled
When using the filter-list and project-list plugins I ran into an issue where NullPointerExceptions were being thrown. I turned out the issue is in AccessLogRequestInfo when the Cookie header doesn't exists. The line that causes the exception is a log.debug line. I am including a patch that check...
Apache Tomcat 6.0.18 - utf8 Directory Traversal
Apache Tomcat 6.0.18 - utf8 Directory Traversal /Apache Tomcat include include include include include include include include include include define EXPLOIT "GET /%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd HTTP/1.0\n\n" define RCVBUFSIZE 9999 define tester "root:x" void cls char esc = 27;...
Apache Tomcat UTF-8 Directory Traversal
/Apache Tomcat include include include include include include include include include include define EXPLOIT "GET /%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd HTTP/1.0\n\n" define RCVBUFSIZE 9999 define tester "root:x" void cls char esc = 27; printf"%c%s",esc,"2J"; printf"%c%s",esc,"1;1H";...
Apache Tomcat < 6.0.18 UTF8 Directory Traversal Vulnerability
Exploit for multiple platform in category remote exploits ============================================================= Apache Tomcat include include include include include include include include include include define EXPLOIT "GET /%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd HTTP/1.0\n\n...
Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal
/Apache Tomcat include include include include include include include include include include define EXPLOIT "GET /%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd HTTP/1.0\n\n" define RCVBUFSIZE 9999 define tester "root:x" void cls char esc = 27; printf"%c%s",esc,"2J"; printf"%c%s",esc,"1;1H";...
Apache Tomcat 5.5.x < 5.5.30
According to its self-reported version number, the Apache Tomcat server listening on the remote host is 5.5.x prior to 5.5.30. It is, therefore, affected by multiple vulnerabilities : - An error in the access restriction on a 'ServletContext' attribute which holds the location of the work directo...