Apache Tomcat 6.0.13 - Insecure Cookie Handling Quote Delimiter Session ID Disclosure

Apache Tomcat 6.0.13 - Insecure Cookie Handling Quote Delimiter Session ID Disclosure source: https://www.securityfocus.com/bid/25316/info Apache Tomcat is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data. Attackers can exploit...

CVE-2007-3382: Exposure of Sensitive Information to an Unauthorized Actor

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

Fixed in Apache Tomcat 6.0.14

Low: Cross-site scripting CVE-2007-2449 JSPs within the examples web application did not escape user provided data before including it in the output. This enabled a XSS attack. These JSPs now filter the data before use. This issue may be mitigated by undeploying the examples web application. Note...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Name or 2 Value field, related to error messages...

CVE-2007-3384

Multiple cross-site scripting XSS vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Name or 2 Value field, related to error messages...

CVE-2007-3384

Apache Tomcat 3.3.x is affected by CVE-2007-3384: multiple XSS vulnerabilities in the examples/servlet/CookieExample allow remote attackers to inject arbitrary script/HTML via the Name or Value fields, related to error messages, in Tomcat 3.3 through 3.3.2. Exploitation details are described acro...

Apache Tomcat错误消息报告跨站脚本漏洞

CVE ID:CVE-2007-3384 CNCVE ID:CNCVE-20073384 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 当报告错误消息时，在显示前Tomcat没有正确过滤用户提供的数据，可导致跨站脚本攻击，攻击者诱使用户访问可导致获得敏感信息。 Apache Software Foundation Tomcat 3.3.2 Apache Software Foundation Tomcat 3.3.1 a Apache Softwar...

CVE-2007-3384: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Name or 2 Value field, related to error messages...

FreeBSD : tomcat -- multiple vulnerabilities (872623af-39ec-11dc-b8cc-000fea449b8a)

Apache Project reports : The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.36 stable. This build contains numerous library updates, A small number of bug fixes and two important security fixes. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

CVE-2007-3383

Cross-site scripting XSS vulnerability in SendMailServlet in the examples web application examples/jsp/mail/sendmail.jsp in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, relat...

Cross site scripting

Cross-site scripting XSS vulnerability in SendMailServlet in the examples web application examples/jsp/mail/sendmail.jsp in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, relat...

CVE-2007-3383

Cross-site scripting XSS vulnerability in SendMailServlet in the examples web application examples/jsp/mail/sendmail.jsp in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, relat...

CVE-2007-3383

Cross-site scripting XSS vulnerability in SendMailServlet in the examples web application examples/jsp/mail/sendmail.jsp in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, relat...

CVE-2007-3383

CVE-2007-3383 is an XSS flaw in Apache Tomcat’s SendMailServlet (examples/jsp/mail/sendmail.jsp) affecting Tomcat 4.0.0–4.0.6 and 4.1.0–4.1.36. The vulnerability allows remote attackers to inject arbitrary script/HTML via the From field (and possibly other fields) during error-message generation....

CVE-2007-3383: Undefined Security Weakness

Cross-site scripting XSS vulnerability in SendMailServlet in the examples web application examples/jsp/mail/sendmail.jsp in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, relat...

CVE-2007-3383: XSS in Tomcat send mail example

CVE-2007-3383: XSS in Tomcat send mail example Severity: Low Cross-site scripting Vendor: The Apache Software Foundation Versions Affected: 4.0.0 to 4.0.6 4.1.0 to 4.1.36 Description: When reporting error messages, the SendMailServlet does not filter user supplied data before display. This enable...

Apache Tomcat SendMailServlet example vulnerable to cross-site scripting via FROM field

Overview The example SendMailServlet page that comes with Apache Tomcat is vulnerable to cross-site scripting via the "From" field. Description Apache Tomcat is an implementation of the Java Servlet and JavaServer Page JSP technologies. Apache Tomcat includes a sample page called SendMailServlet,...

Apache Tomcat Connector (mod_jk) Remote Exploit (exec-shield)

No description provided by source. / Fedora Core 5,6 exec-shield based Apache Tomcat Connector modjk remote overflow exploit by Xpl017Elz Advanced exploitation in exec-shield Fedora Core case study URL: http://x82.inetcop.org/h0me/papers/FCexploit/FCexploit.txt...

Apache Tomcat Connector (mod_jk) Remote Exploit (exec-shield)

No description provided by source. / Fedora Core 5,6 exec-shield based Apache Tomcat Connector modjk remote overflow exploit by Xpl017Elz Advanced exploitation in exec-shield Fedora Core case study URL: http://x82.inetcop.org/h0me/papers/FCexploit/FCexploit.txt Reference:...

Apache Tomcat Connector mod_jk - 'exec-shield' Remote Overflow

/ Fedora Core 5,6 exec-shield based Apache Tomcat Connector modjk remote overflow exploit by Xpl017Elz Advanced exploitation in exec-shield Fedora Core case study URL: http://x82.inetcop.org/h0me/papers/FCexploit/FCexploit.txt Reference: https://www.securityfocus.com/bid/22791 vendor:...