7665 matches found
Session Fixation
Description Session fixation allows an attacker to impersonate a user by abusing an authenticated session ID SID. This attack can occur when a web application: •Fails to supply a new, unique SID to a user following a successful authentication •Allows a user to provide the SID to be used after...
Apache Tomcat < 10.1.13 Vulnerability
Binary data 701444.pasl...
Fixed in Apache Tomcat 8.5.93
Moderate: Open redirect CVE-2023-41080 If the ROOT default web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice. This was fixed with commit 4998ad74. This issue was reported ...
Apache Tomcat 10.1.0.M1 < 10.1.13
The version of Tomcat installed on the remote host is prior to 10.1.13. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.13security-10 advisory. - URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache...
Apache Tomcat 11.0.0.M1 < 11.0.0.M11 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 11.0.0.M11. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.0-m11security-11 advisory. - URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication featur...
Apache Tomcat 9.0.0.M1 < 9.0.80
The version of Tomcat installed on the remote host is prior to 9.0.80. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.80security-9 advisory. - URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.Th...
Fixed in Apache Tomcat 10.1.13
Moderate: Open redirect CVE-2023-41080 If the ROOT default web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice. This was fixed with commit bb4624a9. This issue was reported ...
Apache Tomcat < 8.5.93 Vulnerability
Binary data 701447.pasl...
KLA52554 SB vulnerability in Apache Tomcat
Security vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories Fixed in Apache Tomcat 8.5.93 Fixed in Apache Tomcat 9.0.80 Fixed in Apache Tomcat 8.5.93 Fixed in Apache Tomcat 10.1.13 Exploitation Malware exis...
Fixed in Apache Tomcat 9.0.80
Moderate: Open redirect CVE-2023-41080 If the ROOT default web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice. This was fixed with commit 77c0ce2d. This issue was reported ...
Apache Tomcat 输入验证错误漏洞
Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server. The program implements the Servlet and JavaServer Page JSP support. An open redirection vulnerability exists in Apache Tomcat, which stems from the FORM authentication feature not handling target...
Apache Tomcat < 11.0.0-M11 Vulnerability
Binary data 701445.pasl...
Apache Tomcat < 9.0.80 Vulnerability
Binary data 701446.pasl...
PT-2023-4582
Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.92 Apache Tomcat versions 9.0.0-M1 through 9.0.79 Apache Tomcat versions 10.1.0-M1 through 10.0.12 Apache Tomcat versions 11.0.0-M1 through 11.0.0-M10 Description The issue is related to a URL redirecti...
Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities
Summary IBM Data Risk Manager IDRM 2.0.6.17, which is the only supported version, is affected by multiple vulnerabilities. The vulnerabilities have been addressed in the updated version of IDRM 2.0.6.18. Please see the remediation steps below to apply the fix. All customers are encouraged to act...
Medium: tomcat
Issue Overview: A flaw was found in Apache Tomcat. The HTTP header parsing code used an approach to end-of-line EOL parsing that allowed some invalid HTTP headers to be parsed as valid. This led to the possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that...
Security Bulletin: Vulnerability in Apache Tomcat Server (CVE-2023-28709 ) affects Power HMC
Summary Apache Tomcat Server is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-28709 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by an incomplete fix for CVE-2023-24998 related to the failure to...
Atlassian Confluence 7.13.15 < 7.13.19 / 7.19.7 < 7.19.11 / 8.1.1 < 8.4.1 DoS (CONFSERVER-90185)
The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-90185 advisory. - The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If...
Ivanti patches second zero-day vulnerability being used in attacks
Ivanti has issued a patch to address a second critical zero-day vulnerability that is under active attack. The vulnerability is said to be used in combination with the first vulnerability we discussed some days ago. The Cybersecurity and Infrastructure Security Agency CISA has added the new...
