tomcat: Vary header not added by CORS filter leading to cache poisoning

A vulnerability was discovered in Tomcat where the CORS Filter did not send a "Vary: Origin" HTTP header. This potentially allowed sensitive data to be leaked to other visitors through both client-side and server-side caches...

Discuz!x官方 敏感信息泄露

简要描述： 由于官方项目的DEBUG缓存未清除，导致服务器大量信息泄漏。 当然一般其他网站只要未使用过DEBUG包的项目该问题不存在 详细说明： dbhost = 172.32.1.168 dbuser = superbase dbpw = Oh dbcharset = gbk pconnect = 0 dbname = superbase tablepre = pre 漏洞证明： http://www.discuz.net/data/debugadmin.php?I //phpinfo; http://www.discuz.net/data/debugadmin.php?C&c=...