9907 matches found
CVE-2006-2435
Unspecified vulnerability in IBM WebSphere Application Server 5.0.2 and earlier, and 5.1.1 and earlier, has unknown impact and attack vectors related to "Inserting certain script tags in urls that may allow unintended execution of scripts."...
CVE-2006-2436
WebSphere Application Server 5.0.2 (or earlier cumulative fixes) stores admin and LDAP passwords in plaintext in FFDC logs following failed logins, enabling privilege escalation if logs are accessed. The underlying cause is plaintext credential logging in FFDC. Affected component: WebSphere Appli...
CVE-2006-2430
CVE-2006-2430 affects IBM WebSphere Application Server: versions 5.0.2 and earlier, 5.1.1 and earlier, and 6.0.2 up to 6.0.2.7. The vulnerability arises because user credentials are recorded in plaintext in addNode.log, which can allow attackers to gain privileges. Supported connected documents c...
CVE-2006-2431
Summary: The CVE-2006-2431 issue is a cross-site scripting (XSS) vulnerability in the IBM WebSphere Application Server SOAP connector error page. Affected versions: WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up to 6.0.2.7. Component and cause: The vulnerabili...
CVE-2006-2435
Technical details for CVE-2006-2435 are not publicly disclosed in the provided documents; the records only reiterate an unspecified vulnerability in IBM WebSphere Server with potential script-injection in URLs. Monitor for updates in connected sources.
CVE-2006-2432
CVE-2006-2432 affects IBM WebSphere Application Server 5.0.2 (and earlier cumulative fixes) and 5.1.1 (and earlier cumulative fixes); on Solaris, a crafted LTPA token enables EJB access. The NVD entry assigns a CVSSv2 base score of 7.5 (HIGH) with network attack vector, low attack complexity, and...
CVE-2006-2433
Technical details for CVE-2006-2433 are not publicly available in the provided documents; no affected product, vulnerable component, impact, or remediation is specified here. Monitor for updates.
CVE-2006-2429
Technical details are not publicly available in the provided connected documents; the CVE entry content remains the same as the initial description. Monitor for updates.
SAP Web Application Server crossite scripting
Crossite scripting with error messages...
vulnerability details
Release Date: 03/01/2006 Affected Applications: SAP WebAS Kernel up to version 7.00 Affected Platforms: Platform-Independant Local / Remote: Remote Severity: Medium to High Author: A. Grossmann arnold.grossmann at gmail.com Vendor Status: Confirmed Product Overview cited from SAP :...
Macromedia ColdFusion MX application server crossite scripting
Crossite scripting with error pages...
Moderate: Red Hat Security Advisory: struts security update for Red Hat Application Server
An updated Struts package that fixes several security issues is now available for Red Hat Application Server. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Struts is a framework for building web applications with Java. A validation bug was...
Design/Logic Flaw
IBM WebSphere Application Server 4.0.1 through 4.0.3 allows remote attackers to cause a denial of service application crash via an HTTP request with a large header...
CVE-2006-1619
IBM WebSphere Application Server 4.0.1 through 4.0.3 allows remote attackers to cause a denial of service application crash via an HTTP request with a large header...
CVE-2006-1619
CVE-2006-1619 affects IBM WebSphere Application Server 4.0.1–4.0.3. A remote denial of service is possible when an HTTP request contains a large header, causing an application crash. Root cause relates to header handling. No remediation details are provided in the connected documents.
Orion Application Server Crafted Filename Extension JSP Script Source Disclosure
The remote host is running Orion Application Server, an application server running on a Java2 platform. According to its banner, the version of Orion installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue t...
CVE-2006-1393
Multiple cross-site scripting XSS vulnerabilities in the modpubcookie Apache application server module in University of Washington Pubcookie 1.x, 3.0.0, 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified attack...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Microsoft IIS ISAPI filter aka application server module in University of Washington Pubcookie 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified attack vecto...
Design/Logic Flaw
Orion Application Server before 2.0.7, when running on Windows, allows remote attackers to obtain the source code of JSP files via 1 . dot and 2 space characters in the extension of a URL...