Apache Tomcat Windows安装程序默认空口令漏洞

BUGTRAQ ID: 36954 CVE ID: CVE-2009-3548 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Windows安装程序默认对管理用户设置了空口令。如果在安装过程中没有更改这个口令，就会使用空口令创建各种管理用户。 Tomcat 5.5.0 to 5.5.28 Tomcat 6.0.0 to 6.0.20 厂商补丁： Apache Group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

tomcat: XSS in Apache Tomcat calendar application

Cross-site scripting XSS vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, relat...

Important: Red Hat Security Advisory: tomcat security update

Updated tomcat packages that fix several security issues are now available for Red Hat Application Server v2. This update has been rated as having important security impact by the Red Hat Security Response Team. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP...

Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability

No description provided by source. The following examples are available: +++ GET /myapp/MyCookies HTTP/1.1 Host: localhost Cookie: name="val " ue" Cookie: name1=moi +++...

Apache Tomcat Form Authentication Username Enumeration Weakness

Exploit for unknown platform in category remote exploits =============================================================== Apache Tomcat Form Authentication Username Enumeration Weakness =============================================================== Title: Apache Tomcat Form Authentication Usernam...

Apache Tomcat Form Authentication Username Enumeration Weakness

No description provided by source. Attackers can use readily available tools to exploit this issue. The following example POST data is available: POST /jsecuritycheck HTTP/1.1 Host: www.example.com jusername=tomcat&jpassword=%...

Apache Tomcat Manager Application Deployer Authenticated Code Execution

This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a PUT request. The manager application can also be abused using /manager/html/upload, but that method is no...

Apache Tomcat Manager Authenticated Upload Code Execution

This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on...

Apache Tomcat - Form Authentication Username Enumeration

Apache Tomcat - Form Authentication Username Enumeration Attackers can use readily available tools to exploit this issue. The following example POST data is available: POST /jsecuritycheck HTTP/1.1 Host: www.example.com jusername=tomcat&jpassword=%...

Apache Tomcat for Windows backdoor account

admin account with empty password is created during installation...

ToutVirtual VirtualIQ Multiple Vulnerabilities

Secure Network - Security Research Advisory Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected: ToutVirtual VirtualIQ Professional 3.2 build 7882 Systems not affected: -- Severity: High Local/Remote: Remote Vendor URL: http://www.toutvirtual.com Authors: Alberto Triver...

[SECURITY] CVE-2009-3548 Apache Tomcat Windows Installer insecure default administrative password

CVE-2009-3548: Apache Tomcat Windows Installer insecure default administrative password Severity: Low Vendor: The Apache Software Foundation Versions Affected: Tomcat 5.5.0 to 5.5.28 Tomcat 6.0.0 to 6.0.20 The unsupported Tomcat 3.x, 4.0.x, 4.1.x and 5.0.x versions may be also affected...

Apache Tomcat Cookie Quote Handling Remote Information Disclosure

Exploit for unknown platform in category remote exploits =============================================================================== Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability ===============================================================================...

Apache Tomcat - Cookie Quote Handling Remote Information Disclosure

Apache Tomcat - Cookie Quote Handling Remote Information Disclosure The following examples are available: +++ GET /myapp/MyCookies HTTP/1.1 Host: localhost Cookie: name="val " ue" Cookie: name1=moi +++...

Apache Tomcat - Cookie Quote Handling Remote Information Disclosure

The following examples are available: +++ GET /myapp/MyCookies HTTP/1.1 Host: localhost Cookie: name="val " ue" Cookie: name1=moi +++ http://www.example.com/examples/servlets/servlet/CookieExample?cookiename=test&cookievalue=test%5c%5c%22%3B+Expires%3DThu%2C+1+Jan+2009+00%3A00%3A01+UTC%...

Apache Tomcat - Form Authentication 'Username' Enumeration

Attackers can use readily available tools to exploit this issue. The following example POST data is available: POST /jsecuritycheck HTTP/1.1 Host: www.example.com jusername=tomcat&jpassword=%...

toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities

toutvirtual virtualiq pro 3.2 - Multiple Vulnerabilities &redirectSecure Network - Security Research Advisory Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected: ToutVirtual VirtualIQ Professional 3.2 build 7882 Systems not affected: -- Severity: High Local/Remote:...

ToutVirtual VirtualIQ Pro 3.2 Multiple Vulnerabilities

No description provided by source. &redirectSecure Network - Security Research Advisory Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected: ToutVirtual VirtualIQ Professional 3.2 build 7882 Systems not affected: -- Severity: High Local/Remote: Remote Vendor URL:...

ToutVirtual VirtualIQ Pro 3.2 Multiple Vulnerabilities

Exploit for jsp platform in category web applications ====================================================== ToutVirtual VirtualIQ Pro 3.2 Multiple Vulnerabilities ====================================================== Vuln name: ToutVirtual VirtualIQ Pro Multiple Vulnerabilities Systems affected...

openSUSE 10 Security Update : apache2-mod_jk (apache2-mod_jk-6599)

Certain HTTP request could confuse the JK connector in Apache Tomcat which could result in a user seeing responses destined for other users CVE-2008-5519. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...