10045 matches found
PT-2011-3169
Name of the Vulnerable Software and Affected Versions Liferay Portal Community Edition CE versions 6.0.0 through 6.0.5 Description The issue allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Enti...
PT-2011-3228
Name of the Vulnerable Software and Affected Versions Liferay Portal Community Edition CE versions 5.x through 6.0.5 GA Description The issue allows remote attackers to execute arbitrary commands. This is due to an unspecified vulnerability in the XSL Content portlet when Apache Tomcat is used...
PT-2011-3227
Name of the Vulnerable Software and Affected Versions Liferay Portal Community Edition CE versions prior to 6.0.6 GA Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via a message title when Apache Tomcat is used. Recommendation...
PT-2011-3170
Name of the Vulnerable Software and Affected Versions Liferay Portal Community Edition CE versions 5.x through 6.0.5 GA Description The issue allows remote authenticated users to read arbitrary XSL and XML files. This is possible due to a flaw in the XSL Content portlet when used with Apache Tomc...
CVE-2011-1571: Undefined Security Weakness
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition CE 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors...
CVE-2011-1502: Exposure of Sensitive Information to an Unauthorized Actor
Liferay Portal Community Edition CE 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity aka XXE issue...
CVE-2011-1570: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Liferay Portal Community Edition CE 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030...
Apache Tomcat '@ServletSecurity' 安全模式绕过漏洞
No description provided by source...
Apache Tomcat 拒绝服务攻击漏洞
No description provided by source...
Apache Tomcat 跨站脚本攻击漏洞
No description provided by source...
Apache Tomcat 6.x 默认配置跨站脚本攻击漏洞
No description provided by source...
Apache Tomcat 7.0.11 登陆绕过漏洞
No description provided by source...
[SECURITY] CVE-2011-1475 Apache Tomcat information disclosure
CVE-2011-1475 Apache Tomcat information disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.11 - Earlier versions are not affected Description: Changes introduced to the HTTP BIO connector to support Servlet 3.0 asynchronous requests did...
Apache Tomcat information leakage
Under some conditions, information may be sent to wrong client...
CVE-2011-1475
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for...
CVE-2011-1183
Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for...
Design/Logic Flaw
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for...
CVE-2011-1475
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for...
Design/Logic Flaw
Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for...
CVE-2011-1183
Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for...