CVE-2016-9879

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...

CVE-2016-9879

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to...

CVE-2016-9879

CVE-2016-9879 affects Spring Security 3.2.x/4.1.x/4.2.x prior to fixed versions. The root cause is how path parameters are handled in the Servlet API: getPathInfo() may include encoded "/" characters, allowing an attacker to bypass security constraints when a request contains a path parameter wit...

Fixed in Apache Tomcat 6.0.50

Note: The issue below was fixed in Apache Tomcat 6.0.49 but the release vote for the 6.0.49 release candidate did not pass. Therefore, although users must download 6.0.50 to obtain a version that includes the fix for this issue, version 6.0.49 is not included in the list of affected versions...

Apache Tomcat 8.5.0 < 8.5.9

The version of Tomcat installed on the remote host is prior to 8.5.9. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.9security-8 advisory. - A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to...

Information Disclosure

Apache Tomcat is vulnerable to Information Disclosure. This is caused by the error handling of the send file processing code for the NIO HTTP connector causing information leakage between requests and the response body which allows an attacker to gain access to sensitive information...

Cisco Unified Communications Manager 7 / 8 / 9 Directory Traversal

Exploit Title: Cisco Unified Communications Manager Administrative Web Interface Directory traversal CVE-2013-5528 Date: 7th December 2016 Exploit Author: justpentest Vendor Homepage: https://software.cisco.com/ Software Link: https://software.cisco.com/download/navigator.html?mdfid=268439621...

Fixed in Apache Tomcat 9.0.0.M15

Note: The issue below was fixed in Apache Tomcat 9.0.0.M14 but the release vote for the 9.0.0.M14 release candidate did not pass. Therefore, although users must download 9.0.0.M15 to obtain a version that includes the fix for this issue, version 9.0.0.M14 is not included in the list of affected...

Fixed in Apache Tomcat 8.5.9

Important: Information Disclosure CVE-2016-8745 A bug in the error handling of the send file code for the NIO HTTP connector resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests...

Cisco Unified Communications Manager 789 - Directory Traversal

Cisco Unified Communications Manager 789 - Directory Traversal Exploit Title: Cisco Unified Communications Manager Administrative Web Interface Directory traversal CVE-2013-5528 Date: 7th December 2016 Exploit Author: justpentest Vendor Homepage: https://software.cisco.com/ Software Link:...

Apache Tomcat Local Elevation of Privilege Vulnerability (CNVD-2016-12018)

Apache Tomcat is the United States Apache Apache Software Foundation under the Jakarta project of a lightweight Web application server, which is mainly used for the development and debugging of JSP programs for small and medium-sized systems. A local elevation of privilege vulnerability exists in...

Cisco Unified Communications Manager 7/8/9 - Directory Traversal

Exploit Title: Cisco Unified Communications Manager Administrative Web Interface Directory traversal CVE-2013-5528 Date: 7th December 2016 Exploit Author: justpentest Vendor Homepage: https://software.cisco.com/ Software Link: https://software.cisco.com/download/navigator.html?mdfid=268439621...

Apache Tomcat Local Elevation of Privilege Vulnerability

Apache Tomcat is the United States Apache Apache Software Foundation under the Jakarta project of a lightweight Web application server, which is mainly used for the development and debugging of JSP programs for small and medium-sized systems. A local elevation of privilege vulnerability exists in...

Apache Tomcat multiple versions of a remote code execution CVE-2016-8735(POC)-vulnerability warning-the black bar safety net

Background description Tomcat is by Apache Software Foundation subordinate's Jakarta a project development Servlet vessel, in accordance with Sun Microsystems to provide the technical specifications, the realization of the Servlet and JavaServer Page（JSP）support, and provides as aWeb serversome...

SOL49160100 - Apache Tomcat vulnerability CVE-2016-6817

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...

Apache Tomcat 8.5.0 < 8.5.8 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.5.8. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.5.8security-8 advisory. - Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39...

SOL50116122 - Apache Tomcat vulnerability CVE-2016-6816

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL49820145 - Apache Tomcat vulnerability CVE-2016-8735

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2016-0011

An update of apache-tomcat,mercurial packages for PhotonOS has been released...

CentOS 7 : tomcat (CESA-2016:2599)

An update for tomcat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...