CVE-2013-4204

Google Web Toolkit (GWT) includes multiple XSS vulnerabilities in the JUnit files within GWTTestCase, affecting versions prior to 2.5.1 RC1. The root cause is improper handling in the JUnit-related code paths, enabling remote attackers to inject arbitrary web script or HTML via unspecified vector...

CVE-2012-2696

The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...

Cross site request forgery (csrf)

The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...

CVE-2012-2696

CVE-2012-2696 is a privilege-check flaw in the Red Hat Enterprise Virtualization Manager (RHEV-M) backend before 3.1. An authenticated attacker could issue queries against the RHEV-M SOAP or GWT APIs and read data they should not access, indicating an authorisation bypass in the back end. Connect...

CVE-2012-2696: Undefined Security Weakness

The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...

Important: Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.1

Red Hat Enterprise Virtualization Manager 3.1 is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each vulnerability from the C...

rhev: backend allows unprivileged queries

The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...

CVE-2012-4563

CVE-2012-4563 is an XSS vulnerability in Google Web Toolkit (GWT) 2.4 Beta and release candidates prior to 2.4.0. An attacker could inject arbitrary script/HTML via unspecified vectors. The issue is noted as an incomplete fix in related advisories, and the recommended remediation is to upgrade to...

CVE-2012-4563: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Google Web Toolkit GWT 2.4 Beta and release candidates before 2.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5920: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Google Web Toolkit GWT 2.4 through 2.5 Final, as used in JBoss Operations Network ON 3.1.1 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this issue exists because of an incomplet...

hupa webmail 0.0.2 - Persistent Cross-Site Scripting

hupa webmail 0.0.2 - Persistent Cross-Site Scripting !/usr/bin/python ''' Exploit Title: Hupa Webmail Stored XSS Date: 14/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://james.apache.org/hupa/ Software Link:...

Hupa Webmail 0.0.2 Stored XSS

Exploit for java platform in category web applications !/usr/bin/python ''' Exploit Title: Hupa Webmail Stored XSS Date: 14/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://james.apache.org/hupa/ Software Link:...

hupa webmail 0.0.2 - Persistent Cross-Site Scripting

!/usr/bin/python ''' Exploit Title: Hupa Webmail Stored XSS Date: 14/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://james.apache.org/hupa/ Software Link: http://repo1.maven.org/maven2/org/apache/james/hupa/hupa/0.0.2/hupa-0.0.2.war Version: 0.0.2 Gr33Tz: @aviadgolan ,...

Hupa Webmail 0.0.2 Cross Site Scripting

!/usr/bin/python ''' Exploit Title: Hupa Webmail Stored XSS Date: 14/08/2012 Exploit Author: Shai rod @NightRang3r Vendor Homepage: http://james.apache.org/hupa/ Software Link: http://repo1.maven.org/maven2/org/apache/james/hupa/hupa/0.0.2/hupa-0.0.2.war Version: 0.0.2 Gr33Tz: @aviadgolan ,...

CVE-2012-2963: Improper Authentication

The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not require authentication for the gwt/BugReport script, which allows remote attackers to obtain sensitive information by downloading a .tgz file...

CA ARCserve D2D GWT RPC Request Credentials Disclosure (CVE-2011-3011)

A credentials disclosure vulnerability has been reported in CA ARCserve D2D. The vulnerability is due to an error while processing Google Web Toolkit GWT RPC requests. A remote attacker can exploit this vulnerability by sending a specially crafted RPC request to an affected server. Successful...

CA Arcserve D2D GWT RPC Credential Information Disclosure

$Id: caarcserverpcauthbypass.rb 13467 2011-08-01 21:20:29Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

CA Arcserve D2D GWT RPC Credential Information Disclosure

Exploit for jsp platform in category web applications $Id: caarcserverpcauthbypass.rb 13467 2011-08-01 21:20:29Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more informati...

CA ARCserver D2D GWT RPC Request Multiple Vulnerabilities

CA ARCserver D2D is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Computer Associates ARCserve D2D homepageServlet Servlet Information Disclosure

The installed version of ARCserve D2D, a disk-based backup product from Computer Associates, allows an unauthenticated, remote attacker to discover the username and password used by the affected application. This can be accomplished by sending a specially crafted POST request to the...