7804 matches found
Apache Tomcat SecurityManager Security Bypass Vulnerability
Bugtraq ID:46177 CVE:CVE-2010-3718 Apache Tomcat is prone to a security-bypass vulnerability. Successful exploits will allow attackers to bypass certain security restrictions and gain access to arbitrary files and directories in the context of the web server. This issue affects Apache Tomcat...
Apache Tomcat 7.0.x < 7.0.19 Multiple Vulnerabilities
Binary data 800597.prm...
Apache Tomcat 7.0.x < 7.0.17 Multiple Vulnerabilities
Binary data 5996.pasl...
Fixed in Apache Tomcat 7.0.19
Low: Information disclosure CVE-2011-2526 Tomcat provides support for sendfile with the HTTP NIO and HTTP APR connectors. sendfile is used automatically for content served via the DefaultServlet and deployed web applications may use it directly via setting request attributes. These request...
[SECURITY] CVE-2011-2526 Apache Tomcat Information disclosure and availability vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2011-2526: Apache Tomcat Information disclosure and availability vulnerabilities Severity: low Vendor: The Apache Software Foundation Versions Affected: Tomcat 7.0.0 to 7.0.18 Tomcat 6.0.0 to 6.0.32 Tomcat 5.5.0 to 5.0.33 Previous, unsupported...
Apache Tomcat information leakage
Some security limitations are not checked for sendfile...
Apache Tomcat sendfile请求安全限制绕过和拒绝服务漏洞
CVE ID: CVE-2011-2526 Tomcat是由Apache软件基金会下属的Jakarta项目开发的一个Servlet容器，按照Sun Microsystems提供的技术规范，实现了对Servlet和JavaServer Page（JSP）的支持，并提供了作为Web服务器的一些特有功能。 Apache Tomcat在sendfile请求的处理上存在安全限制绕过和拒绝服务漏洞，本地攻击者可利用此漏洞绕过安全限制或造成拒绝服务。 1）当Apache Tomcat运行在安全管理器下时没有正确验证sendfile请求的属性，可被恶意Web应用程序利用绕过目标限制并泄露本地文件。...
CVE-2011-2526
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service infinite lo...
Design/Logic Flaw
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service infinite lo...
CVE-2011-2526
CVE-2011-2526 affects Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19. When sendfile is enabled for the HTTP APR or HTTP NIO connector, Tomcat may not validate certain request attributes, allowing a local attacker to bypass file access restrictions or trigger a denial ...
CVE-2011-2526
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service infinite lo...
CVE-2011-2526
Removed by vendor...
CVE-2011-2526
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service infinite lo...
NATO Server Hacked by 1337day Inj3ct0r and Backup Leaked !
NATO Server Hacked by 1337day Inj3ct0r and Backup Leaked ! Team Inj3ct0r 1337day claim to hack Apache Tomcat Version 5.5.9 of NATO. The North Atlantic Treaty Organization or NATO also called the North Atlantic Alliance, is an inter governmental military alliance based on the North Atlantic Treaty...
Apache Tomcat "MemoryUserDatabase"信息泄露漏洞
BUGTRAQ ID: 48456 Tomcat是由Apache软件基金会下属的Jakarta项目开发的一个Servlet容器，按照Sun Microsystems提供的技术规范，实现了对Servlet和JavaServer Page（JSP）的支持，并提供了作为Web服务器的一些特有功能。 Apache Tomcat在MemoryUserDatabase的实现上存在信息泄露漏洞，远程攻击者可利用此漏洞获取敏感信息。 此漏洞源于在通过使用MemoryUserDatabase的JMX创建用户时存在的错误。如果出现意外，可导致用创建的用户密码登陆Tomcat。 Apache Group...
Design/Logic Flaw
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...
CVE-2011-2204
CVE-2011-2204 affects Apache Tomcat when MemoryUserDatabase logs password data on JMX user creation errors. Affected: Tomcat 5.5.x < 5.5.34, 6.x < 6.0.33, 7.x
CVE-2011-2204
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...
CVE-2011-2204
Removed by vendor...
CVE-2011-2204
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...