CVE-2007-5461: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag...

Apache Tomcat (webdav) Remote File Disclosure Exploit

Exploit for multiple platform in category remote exploits ===================================================== Apache Tomcat webdav Remote File Disclosure Exploit ===================================================== !/usr/bin/perl Apache Tomcat Remote File Disclosure Zeroday Xploit kcdarookie a...

Apache Tomcat (webdav) Remote File Disclosure Exploit

No description provided by source. !/usr/bin/perl Apache Tomcat Remote File Disclosure Zeroday Xploit kcdarookie aka eliteb0y / 2007 thanx to the whole team & andi : +++KEEP PRIV8+++ This Bug may reside in different WebDav implementations, Warp your mind! +You will need auth for the exploit to...

Apache Tomcat - WebDAV Remote File Disclosure

Apache Tomcat - WebDAV Remote File Disclosure !/usr/bin/perl Apache Tomcat Remote File Disclosure Zeroday Xploit kcdarookie aka eliteb0y / 2007 thanx to the whole team & andi : +++KEEP PRIV8+++ This Bug may reside in different WebDav implementations, Warp your mind! +You will need auth for the...

tomcat accept-language xss flaw

Cross-site scripting XSS vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616"...

Apache Tomcat Sample App cal2.jsp 'time' Parameter XSS (CVE-2006-7196)

The remote Apache Tomcat web server includes an example JSP application, 'cal2.jsp', that fails to sanitize user-supplied input before using it to generate dynamic content. An unauthenticated, remote attacker can exploit this issue to inject arbitrary HTML or script code into a user's browser to ...

Fixed in Apache Tomcat 5.5.25, 5.0.SVN

Low: Cross-site scripting CVE-2007-2449 JSPs within the examples web application did not escape user provided data before including it in the output. This enabled a XSS attack. These JSPs now filter the data before use. This issue may be mitigated by undeploying the examples web application. Note...

tomcat-func-xss.txt

Apache Tomcat remote xss Author: handrix Contact: handrixatmorxdotorg Vulnerability: Cross Site Scripting Severity: Medium/High MorX security research team www.morx.org Description: Apache Tomcat remote xss Tomcat provide many example of jsp files, servlet and others. functions.jsp's script is...

Apache Tomcat SendMailServlet sendmail.jsp 'mailfrom' Parameter XSS

The remote web server includes an example JSP application that fails to sanitize user-supplied input before using it to generate dynamic content in the 'examples/SendMailServlet' servlet. An unauthenticated remote attacker can exploit this issue to inject arbitrary HTML or script code into a user...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters...

CVE-2007-4724

Cross-site request forgery CSRF vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters...

CVE-2007-4724

CVE-2007-4724 describes a CSRF vulnerability in the Apache Tomcat calendar examples app, specifically in the file cal2.jsp of the calendar example. The issue allows a remote attacker to add events as arbitrary users by supplying the time and description parameters, enabling unauthorized calendar ...

tomcat4131-xss.txt

Apache Tomcat/4.1.31 ships with built in examples. One of the example calendar.jsp suffers from input validation error and could be exploited for cross site scriptingand cross site request forgery. XSS http://myserver:myport/examples/jsp/cal/cal2.jsp?time=8am%3cscript%3ealert"XSS!"%3c%2fscript%3e...

CVE-2007-4724: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters...

Apache Tomcat 5.5.15 - cal2.jsp Cross-Site Scripting

Apache Tomcat 5.5.15 - cal2.jsp Cross-Site Scripting source: https://www.securityfocus.com/bid/25531/info Apache Tomcat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...

Apache Tomcat crossite scripting

Crossite scripting in sendmail.jsp, calendar and CookieExample example scripts...

Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability

Apache Tomcat/4.1.31 ships with built in examples. One of the example calendar.jsp suffers from input validation error and could be exploited for cross site scriptingand cross site request forgery. XSS http://myserver:myport/examples/jsp/cal/cal2.jsp?time=8am3cscript3eale rt"XSS!"3c2fscript3e XSR...

Apache Tomcat 5.5.15 - cal2.jsp Cross-Site Scripting

source: https://www.securityfocus.com/bid/25531/info Apache Tomcat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user i...

Apache Tomcat多个远程信息泄露漏洞

BUGTRAQ ID: 25316 CVECAN ID: CVE-2007-3385,CVE-2007-3382 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat处理用户请求数据时存在输入验证漏洞，远程攻击者可能利用此漏洞获取会话相关的敏感信息。 Apache Tomcat没有正确的处理Cookie值中的“" ”字符序列，且错误地将Cookie值中的单引号处理为分隔符，在某些情况下，这可能导致泄露敏感信息，如会话ID。 Apache Group Tomcat 6.0.0 - 6.0.13 Apache Group Tomcat 5.5.0...

Apache Tomcat Host Manager Servlet跨站脚本执行漏洞

BUGTRAQ ID: 25314 CVECAN ID: CVE-2007-3386 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat实现上存在输入验证漏洞，远程攻击者可能利用引漏洞导致跨站脚本执行。 Apache Tomcat的Host Manager Servlet没有正确地过滤用户输入，如果用户向服务器提交了恶意请求的话就可以执行跨站脚本攻击，导致注入并执行任意HTML和Web脚本。 Apache Group Tomcat 6.0.0 - 6.0.13 Apache Group Tomcat 5.5.0 - 5.5.24...