Apache Tomcat 7.0.x < 7.0.68 / 8.0.x < 8.0.32 Multiple Vulnerabilities

Binary data 9313.prm...

tomcat: CSRF token leak

A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to...

tomcat: CSRF token leak

A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to...

tomcat: CSRF token leak

A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to...

Apache Tomcat XSRF Token Disclosure

The remote Apache Tomcat web server is affected by an information disclosure vulnerability in the index page of the Manager and Host Manager applications. An unauthenticated, remote attacker can exploit this vulnerability to obtain a valid cross-site request forgery XSRF token during the redirect...

Medium: tomcat7

Issue Overview: ResourceLinkFactory.setGlobalContext is a public method and was discovered to be accessible by web applications running under a security manager without any checks. This allowed a malicious web application to inject a malicious global context that could in turn be used to disrupt...

The vulnerability of the Apache Tomcat application server allows attackers to bypass the CSRF protection mechanism.

The vulnerability of the Manager and Host Manager components of the Apache Tomcat application server is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to bypass the CSRF protection mechanism by using a token...

CVE-2015-5351

The 1 Manager and 2 Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token...

CVE-2015-5351: Cross-Site Request Forgery (CSRF)

The 1 Manager and 2 Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token...

Fixed in Apache Tomcat 7.0.68

Low: Directory disclosure CVE-2015-5345 When accessing a directory protected by a security constraint with a URL that did not end in a slash, Tomcat would redirect to the URL with the trailing slash thereby confirming the presence of the directory before processing the security constraint. It was...

PT-2016-1314

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 7.0.0 through 7.0.67 Apache Tomcat versions 8.0.0 through 8.0.30 Apache Tomcat versions 9.0.0.M1 and earlier Description The issue is related to the Manager and Host Manager applications in Apache Tomcat, which establish...

Fixed in Apache Tomcat 9.0.0.M3

Moderate: Security Manager bypass CVE-2016-0763 This issue only affects users running untrusted web applications under a security manager. ResourceLinkFactory.setGlobalContext is a public method and was accessible to web applications even when running under a security manager. This allowed a...

Apache Tomcat <= 6.0.13 Host Manager Servlet Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/25314/info Apache Tomcat Host Manager Servlet is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to inject...

Scientific Linux Security Update : tomcat on SL5.x i386/x86_64

A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. CVE-2008-1232 An additional cross-site scripting vulnerability was discovered in the host manager application. A...

Apache Tomcat 5.0.x <= 5.0.30 / 5.5.x < 5.5.25 Multiple Vulnerabilities

According to its self-reported version number, the instance Apache Tomcat running on the remote host is 5.0.x equal to or prior to 5.0.30 or 5.5.x prior to 5.5.25. It is, therefore, affected by multiple vulnerabilities : - An error exists in several JSP example files that allows script injection...

Apache Tomcat < 6.0.18 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat listening on the remote host is prior to 6.0.18. It is, therefore, affected by multiple vulnerabilities : - The remote Apache Tomcat installation is affected by a cross-site scripting vulnerability in the...

Apache Tomcat crossite scripting

host-manager username crossite scripting...

Apache Tomcat Host Manager Servlet 跨站脚本攻击漏洞

No description provided by source...

Apache Tomcat Host Manager 跨站脚本攻击漏洞

No description provided by source...

openSUSE Security Update : tomcat6 (tomcat6-68)

This update of tomcat fixes a cross-site-scripting vulnerabilitiy in the host-manager. CVE-2008-1947 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update tomcat6-68. The text description of this...