Moderate: Red Hat Security Advisory: tomcat security update

Updated tomcat packages that fix three security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter

It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data, leading to...

Apache Tomcat 3.2 Directory Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5838/info Apache Tomcat is reported to be prone to a vulnerability which may enable remote attackers to disclose the contents of directories. This issue is reported to affect Apache Tomcat 3.2.x on HP-UX 11.04 VVOS system...

Apache Tomcat <= 6.0.18 Form Authentication Existing/Non-Existing Username Enumeration Weakness

No description provided by source. source: http://www.securityfocus.com/bid/35196/info Apache Tomcat is prone to a username-enumeration weakness because it displays different responses to login attempts, depending on whether or not the username exists. Attackers may exploit this weakness to disce...

Apache Tomcat <= 6.0.13 JSP Example Web Applications Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24476/info Apache Tomcat is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. Exploiting this vulnerability may allow an attacker to perform cross-site scripting...

Apache Tomcat 5 Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/19106/info Apache Tomcat is prone to an information-disclosure vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to reveal a complete directory listing from any...

Apache Tomcat 3/4 DefaultServlet File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code...

Apache Tomcat 5.5.25 - CSRF Vulnerabilities

No description provided by source. +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti http://ivanobinetti.com Author :...

Apache Tomcat 6.0.10 Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/24058/info Apache Tomcat's documentation web application includes a sample application that is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker...

Apache Tomcat 4.0.x Non-HTTP Request Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8824/info Apache Tomcat 4 has been reported prone to a remotely triggered denial-of-service vulnerability when handling undisclosed non-HTTP request types. When certain non-HTTP request types are handled by the Tomcat HTT...

Apache Tomcat 4.0.3 - Requests Containing MS-DOS Device Names Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28484/info Apache Tomcat is prone to an information-disclosure vulnerability when handling requests that contain MS-DOS device names. Attackers can leverage this issue to obtain potentially sensitive data that could aid i...

Apache Tomcat runtime.getRuntime().exec() Privilege Escalation (win)

No description provided by source. %@ page import=java.util.,java.io.% % % %-- abysssec inc public material just upload this file with abysssec.jsp and execute your command your command will run as administrator . you can download sam file add user or do anything you want . note : please be gentl...

Apache Tomcat 4.0.3 Servlet Mapping Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5193/info A vulnerability has been reported for Apache Tomcat 4.0.3 on Microsoft Windows and Linux platforms. Reportedly, it is possible for an attacker to launch a cross site scripting attack. When servlet mapping is...

Apache Tomcat Remote Exploit (PUT Request) and Account Scanner

No description provided by source. ISOWAREZ RELEASE By KINGCOPE - YEAR 2012 -== Apache Tomcat Remote Exploit and Account Scanner ==- the modified pnscan scanner utility scans a range of IPs to find open apache tomcat servers by trying the following login access combinations: tomcat:tomcat...

Spring Framework arbitrary code execution

No description provided by source. CVE-2010-1622: Spring Framework execution of arbitrary code Severity: Critical Vendor: SpringSource, a division of VMware Versions Affected: 3.0.0 to 3.0.2 2.5.0 to 2.5.6.SEC01 community releases 2.5.0 to 2.5.7 subscription customers Earlier versions may also be...

PHP Hash Table Collision Proof Of Concept

No description provided by source. ! /usr/bin/env python This script was written by Christian Mehlmauer [email protected] https://twitter.com/!/FireFart Sourcecode online at: https://github.com/FireFart/HashCollision-DOS-POC Original PHP Payloadgenerator taken from...

Apache Tomcat 3.2.3/3.2.4 Source.JSP Malformed Request Information Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/4876/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the...

Apache Commons FileUpload and Apache Tomcat - Denial-of-Service

No description provided by source. CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service Author: Oren Hafif, Trustwave SpiderLabs Research This is a Proof of Concept code that was created for the sole purpose of assisting system administrators in evaluating whether their...

Apache Tomcat <= 6.0.13 Host Manager Servlet Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/25314/info Apache Tomcat Host Manager Servlet is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to inject...

Apache Tomcat <= 6.0.16 'HttpServletResponse.sendError()' Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/30496/info Apache Tomcat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...