CVE-2010-0386

The default configuration of Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method. This allows remote attackers to perform Cross-Site Tracing (XST) attacks to steal cookies and authentication credentials by reflecting the contents of client HTTP requests in the response...