PT-2018-15013

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9 Description The issue is caused by the mishandling of data by the application based on an incorrect return by the httpServletRequestauthenticate API when an unprotected URI is accessed. This could all...

CVE-2018-1957: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequestauthenticate API when an unprotected URI is accessed. IBM X-Force ID: 153629...

Design/Logic Flaw

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. Th...

CVE-2016-6812

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. Th...

CVE-2016-6812

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. Th...

PT-2017-5875

Name of the Vulnerable Software and Affected Versions: Spring Security versions 3.1 through 3.2.4 Description: A malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated, due to the proxy ticket authentication using information from the...

用友IUFO远程命令执行(cloudeye演示)

简要描述： 用友IUFO远程命令执行 详细说明： google:inurl:/service/iufo 这个只是其中的一条线索，当然这个已经搜出来10几页以上的站点 应用的使用量比较大，部署采用WebSphere 代码分析: web.xml: NCInvokerServlet nc.bs.framework.server.InvokerServlet NCFindWebServlet nc.bs.framework.server.FindWebResourceServlet NCFindWebServlet /NCFindWeb CommonServletDispatcher...

AddConsumerReciprocalServlet Open Redirect

The AddConsumerReciprocalServlet servlet has an open redirect vulnerability in the doGet method that will allow phishers to lure users away from legitimate JIRA hosted sites. An open redirect vulnerability is caused by an attacker having control over a request parameter that hasn’t been validated...