CVE-2016-6812

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. Th...

用友IUFO远程命令执行(cloudeye演示)

简要描述： 用友IUFO远程命令执行 详细说明： google:inurl:/service/iufo 这个只是其中的一条线索，当然这个已经搜出来10几页以上的站点 应用的使用量比较大，部署采用WebSphere 代码分析: web.xml: NCInvokerServlet nc.bs.framework.server.InvokerServlet NCFindWebServlet nc.bs.framework.server.FindWebResourceServlet NCFindWebServlet /NCFindWeb CommonServletDispatcher...

AddConsumerReciprocalServlet Open Redirect

The AddConsumerReciprocalServlet servlet has an open redirect vulnerability in the doGet method that will allow phishers to lure users away from legitimate JIRA hosted sites. An open redirect vulnerability is caused by an attacker having control over a request parameter that hasn’t been validated...