CVE-2012-2965

CVE-2012-2965 affects Caucho Quercus on Resin prior to version 4.0.29. The vulnerability arises from improper handling of unspecified characters in variable names, related to an HTTP Parameter Contamination issue, with unknown impact and remote attack vectors. Remediation per multiple sources is ...

CVE-2012-2968

Directory traversal vulnerability in Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to create files in arbitrary directories via a .. dot dot in a pathname within an HTTP request...

CVE-2012-2967

CVE-2012-2967 affects Caucho Quercus on Resin prior to 4.0.29, where the == operator is not implemented correctly for comparisons. This misimplementation enables context-dependent outcomes and may allow an attacker to influence behavior, with the CVE entry noting unspecified impact. Several conne...

Caucho Resin Multiple Cross-Site Scripting Vulnerabilities

The host is running Caucho Resin and is prone to multiple cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: secpodcauchoresinmultxssvuln.nasl 5394 2017-02-22 09:22:42Z teissa $ Caucho Resin Multiple Cross-Site Scripting Vulnerabilities Authors: Sooraj KS Copyright: Copyright c...

Caucho Resin < 4.0.7 Multiple XSS Vulnerabilities - Active Check

Caucho Resin is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site scripting

Oracle Mojarra 1.214 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting XSS attacks or execute arbitrary Expression Language EL statements v...

CVE-2010-2087

CVE-2010-2087: Oracle Mojarra 1.2_14 and 2.0.2 (as used in IBM WebSphere Application Server, Caucho Resin, and other apps) fails to properly protect an unencrypted view state. This enables remote attackers to perform cross-site scripting (XSS) or execute arbitrary Expression Language (EL) stateme...

CVE-2010-2032

CVE-2010-2032 concerns multiple XSS flaws in Caucho Resin’s resin-admin/digest.php. Affected products include Resin Professional 3.1.5, 3.1.10, 4.0.6 (and potentially other versions). The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the digest_realm or digest_...

Caucho Technology Resin digest.php Cross Site Scripting Vulnerability

This vulnerability do not need to login.digest.php use the REQUEST method in a wrong way to accept parametersthe malicious user could submit xss code on this page and an attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. exp:...

Caucho Resin Web Server 3.1.2 Cross Site Scripting

hi,brother,I want to post a vul of Caucho Resin web server Exploit Title:Caucho Resin web server 3.1.2 Admin Login digestusername&digestrealm XSS Vulnerability Date: 2010-05-17 Author: flyh4t Software Link: http://www.caucho.com/ Version: Professional 3.1.2 CVE : no P0C:no need of login POST...

Caucho Resin Professional 3.1.5 - resin-admindigest.php Multiple Cross-Site Scripting Vulnerabilities

Caucho Resin Professional 3.1.5 - resin-admindigest.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/40251/info Caucho Resin Professional is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize...

Caucho Resin Professional 3.1.5 - '/resin-admin/digest.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/40251/info Caucho Resin Professional is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of...

resin 1.2 目录遍历漏洞

Caucho Technology Resin 1.2.2存在一个安全问题。远程用户可以获取http根 目录之外的文件的读取权限。通过构造一个特别的包含'/..'或者'/...'的URL, 可能导致目录遍历。 此问题只影响在Windows NT/2000系统中安装的Resin. 测试方法： joetesta （[email protected]提供了如下演示代码： http://localhost:8080/../readme.txt 建议： 厂商补丁： Caucho Technology已经提供了Resin 1.2.3，此版本已经解决了此安全问题。 下载地址：...

CVE-2008-2462

Cross-site scripting XSS vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2008-2462

Cross-site scripting XSS vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2008-2462

CVE-2008-2462 concerns a cross-site scripting (XSS) vulnerability in Resin’s viewfile command. The issue allows remote attackers to inject arbitrary web script or HTML via the file parameter. Affected Resin versions are before 3.0.25 and 3.1.x before 3.1.4; remediation is to upgrade to Resin 3.0....

Caucho Resin vulnerable to XSS via "file" parameter to "viewfile"

Overview The "viewfile" command provided by Caucho Resin contains a cross-site scripting XSS vulnerability in the "file" parameter. Description Caucho Resin is a Java-based application server. The "viewfile" command that is provided with the Resin documentation is vulnerable to XSS via the "file"...

CVE-2003-1513

Multiple cross-site scripting XSS vulnerabilities in example scripts in Caucho Technology Resin 2.0 through 2.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 env.jsp, 2 form.jsp, 3 session.jsp, 4 the move parameter to tictactoe.jsp, or the 5 name or 6 comment fields to...

CVE-2003-1513

CVE-2003-1513 concerns multiple XSS vulnerabilities in Caucho Technology Resin 2.0–2.1.2, exposed via example scripts (env.jsp, form.jsp, session.jsp, tictactoe.jsp with the move parameter, and guestbook.jsp with name/comment fields). The root cause is the failure to properly sanitize user-suppli...