Apache Tomcat 404错误页跨站脚本漏洞

Bugraq ID: 37149 Apache Tomcat是一款开放源码的JSP应用服务器程序。 Apache Tomcat不正确过滤用户输入，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 由于不正确处理404错误页面，在返回给用户后，可导致恶意脚本代码在目标浏览器上执行，泄漏敏感信息。 Apache Software Foundation Tomcat 3.2.1 Apache Software Foundation Tomcat 3.2 Apache Software Foundation Tomcat 3.1.1 Apache Software Foundation...

Apache Tomcat 3.2.1 - 404 Error Page Cross-Site Scripting

Apache Tomcat 3.2.1 - 404 Error Page Cross-Site Scripting Apache Tomcat is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

Apache Tomcat 3.2.1 - 404 Error Page Cross-Site Scripting

Apache Tomcat is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to...

Apache Tomcat v3.2.1 404 Error Page Cross Site Scripting Vulnerability

Exploit for unknown platform in category web applications ====================================================================== Apache Tomcat v3.2.1 404 Error Page Cross Site Scripting Vulnerability ====================================================================== Apache Tomcat is prone to ...

Low: Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server

An updated tomcat package that fixes several security issues is now available for Red Hat Network Satellite Server 5.1. This update has been rated as having low security impact by the Red Hat Security Response Team. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JS...

Low: Red Hat Security Advisory: mod_jk security update for Red Hat Network Satellite Server

An updated modjk package that fixes one security issue is now available for Red Hat Network Satellite Server 5.1 and 5.2. This update has been rated as having low security impact by the Red Hat Security Response Team. modjk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HT...

tomcat6 Denial-Of-Service with AJP connection

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and modjk load balancing are used, allows remote attackers to cause a denial of service application outage via a crafted request with invalid headers, related to temporary blocking of...

mod_jk: session information leak

The JK Connector aka modjk 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving 1 a request from a different client that included a Content-Length header but no POST dat...

tomcat XML parser information disclosure

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the 1 web.xml, 2 context.xml, or 3 tld files of arbitrary web applications via a crafted...

VMSA-2009-0016 : VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.

"a. JRE Security Update JRE update to version 1.5.020, which addresses multiple security issues that existed in earlier releases of JRE. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the following names to the security issues fixed in JRE 1.5.018: CVE-2009-1093,...

ToutVirtual VirtualIQ Pro XSS / XSRF / Execution

Secure Network - Security Research Advisory Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected: ToutVirtual VirtualIQ Professional 3.2 build 7882 Systems not affected: -- Severity: High Local/Remote: Remote Vendor URL: http://www.toutvirtual.com Authors: Alberto Triver...

Apache Tomcat Windows Installer Privilege Escalation Vulnerability

Apache Tomcat Server is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges...

Default credentials

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges...

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges...

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges...

CVE-2009-3548

CVE-2009-3548 affects the Windows installer for Apache Tomcat (versions 6.0.0–6.0.20 and 5.5.0–5.5.28, possibly earlier). The underlying issue is a blank default password for the administrative user, which can be exploited remotely to gain administrative privileges. The linked connected documents...

RedHat Security Advisory RHSA-2009:1562

The remote host is missing updates announced in advisory RHSA-2009:1562. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. It was discovered that the Red Hat Security Advisory RHSA-2007:0876 did not address all possible flaws in the way Tomcat handle...

RedHat Security Advisory RHSA-2009:1563

The remote host is missing updates announced in advisory RHSA-2009:1563. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. It was discovered that the Red Hat Security Advisory RHSA-2008:0195 did not address all possible flaws in the way Tomcat handle...

Apache Tomcat Windows安装程序默认空口令漏洞

BUGTRAQ ID: 36954 CVE ID: CVE-2009-3548 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Windows安装程序默认对管理用户设置了空口令。如果在安装过程中没有更改这个口令，就会使用空口令创建各种管理用户。 Tomcat 5.5.0 to 5.5.28 Tomcat 6.0.0 to 6.0.20 厂商补丁： Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...