Apache JackRabbit - WebDAV XML External Entity

!/usr/bin/env python """ Exploit Title: Jackrabbit WebDAV XXE Date: 25-05-2015 Software Link: http://jackrabbit.apache.org/jcr/ Exploit Author: Mikhail Egorov Contact: 0ang3el gmail com Website: http://0ang3el.blogspot.com CVE: CVE-2015-1833 Category: webapps 1. Description Jackrabbit WebDAV plug...

Apache Jackrabbit XML External Entity Input Vulnerability

Apache Jackrabbit is a full compliance with the Java API version of the content storage specification JCR implementation . An XML external entity injection vulnerability exists in Apache Jackrabbit, which allows remote attackers to exploit the vulnerability by submitting a special XML request to...

Apache JackRabbit 2.0.0 webapp XPath Injection

No description provided by source. Title: Apache JackRabbit webapp XPath Injection Author: ADEO Security Published: 11/08/2010 Version: 2.0.0 Possible all versions Vendor: http://www.apache.org Download: http://www.apache.org/dyn/closer.cgi/jackrabbit/2.0.0/jackrabbit-2.0.0-src.zip Description:...

Apache Jackrabbit 1.4/1.5 Content Repository (JCR) swr.jsp q Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/33360/info Apache Jackrabbit is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code i...

Apache Jackrabbit 1.4/1.5 Content Repository (JCR) search.jsp q Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/33360/info Apache Jackrabbit is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code i...

Apache JackRabbit 2.0.0 XPath Injection

Title: Apache JackRabbit webapp XPath Injection Author: ADEO Security Published: 11/08/2010 Version: 2.0.0 Possible all versions Vendor: http://www.apache.org Download: http://www.apache.org/dyn/closer.cgi/jackrabbit/2.0.0/jackrabbit-2.0.0-src.zip Description: "Apache Jackrabbit is a fully...

Apache JackRabbit 2.0.0 - webapp XPath Injection

Apache JackRabbit 2.0.0 - webapp XPath Injection Title: Apache JackRabbit webapp XPath Injection Author: ADEO Security Published: 11/08/2010 Version: 2.0.0 Possible all versions Vendor: http://www.apache.org Download: http://www.apache.org/dyn/closer.cgi/jackrabbit/2.0.0/jackrabbit-2.0.0-src.zip...

Apache JackRabbit 2.0.0 webapp XPath Injection Vulnerabilty

Exploit for jsp platform in category web applications =========================================================== Apache JackRabbit 2.0.0 webapp XPath Injection Vulnerabilty =========================================================== Title: Apache JackRabbit webapp XPath Injection Author: ADEO...

Apache JackRabbit 2.0.0 - webapp XPath Injection

Title: Apache JackRabbit webapp XPath Injection Author: ADEO Security Published: 11/08/2010 Version: 2.0.0 Possible all versions Vendor: http://www.apache.org Download: http://www.apache.org/dyn/closer.cgi/jackrabbit/2.0.0/jackrabbit-2.0.0-src.zip Description: "Apache Jackrabbit is a fully...

apache Jackrabbit 1.5 跨站脚本漏洞

No description provided by source...

Apache Jackrabbit q参数跨站脚本漏洞

BUGTRAQ ID: 33360 CVECAN ID: CVE-2009-0026 Apache Jackrabbit是一个完全遵守Java API版的内容存储规范（JCR）的实现。 Apache Jackrabbit的search.jsp和swr.jsp页面没有正确地过滤q参数便返回给了用户，这允许远程攻击者通过提交恶意请求执行跨站脚本攻击，在用户浏览器会话中执行任意HTML和脚本代码。 Apache Group Jackrabbit 1.5.0 Apache Group Jackrabbit 1.4 Apache Group ------------...

Apache Jackrabbit 'q' Parameter XSS

The remote host is running Apache Jackrabbit, an open source webapp that implements the Java Content Repository JCR API. The version of Apache Jackrabbit running on the remote host fails to sanitize user input to the 'q' parameter of the 'search.jsp' and 'swr.jsp' pages before including it in...

CVE-2009-0026

Multiple cross-site scripting XSS vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.jsp or 2 swr.jsp...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.jsp or 2 swr.jsp...

CVE-2009-0026

Multiple cross-site scripting XSS vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.jsp or 2 swr.jsp...

CVE-2009-0026

Summary: CVE-2009-0026 affects Apache Jackrabbit prior to 1.5.2, enabling remote XSS via the q parameter to search.jsp and swr.jsp in the webapp. The root cause is improper escaping/validation of user input in these endpoints, allowing injection of arbitrary HTML/JavaScript into a user’s browser....

PT-2009-2741 · Apache · Apache Jackrabbit

Name of the Vulnerable Software and Affected Versions: Apache Jackrabbit versions prior to 1.5.2 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the ...

Apache JackRabbit 1.41.5 Content Repository (JCR) - search.jsp?q Cross-Site Scripting

Apache JackRabbit 1.41.5 Content Repository JCR - search.jsp?q Cross-Site Scripting source: https://www.securityfocus.com/bid/33360/info Apache Jackrabbit is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may levera...

Apache JackRabbit 1.41.5 Content Repository (JCR) - swr.jsp?q Cross-Site Scripting

Apache JackRabbit 1.41.5 Content Repository JCR - swr.jsp?q Cross-Site Scripting source: https://www.securityfocus.com/bid/33360/info Apache Jackrabbit is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage...

[Full-disclosure] [ANNOUNCE] Apache Jackrabbit 1.5.2 released

The Apache Jackrabbit community is pleased to announce the release of Apache Jackrabbit version 1.5.2. The release is available for download at: http://jackrabbit.apache.org/downloads.html See the full release notes below for details about this release. Release Notes -- Apache Jackrabbit -- Versi...