79 matches found
Apache Jetspeed Detection
Detection of Apache Jetspeed Open Portal. This script sends an HTTP GET request and tries to get the version from the response. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Apache Jetspeed Arbitrary File Upload
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Jetspeed Arbitrary File Upload', 'Description' = %q This module exploits the unsecured User Manager REST API and a ZIP file path traversal ...
Apache Jetspeed - Arbitrary File Upload (Metasploit)
Exploit for java platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Jetspeed Arbitrary File Upload', 'Description' = %q This module exploits the unsecure...
Apache Jetspeed - Arbitrary File Upload (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Jetspeed Arbitrary File Upload', 'Description' = %q This module exploits the unsecured User Manager REST API and a ZIP file path traversal ...
Apache Jetspeed Portal URI Path Reflected XSS
The Apache Jetspeed application running on the remote host is affected by a reflected cross-site scripting XSS vulnerability in the /portal script due to improper validation of URI path input before returning it to the users. An unauthenticated, remote attacker can exploit this, via a specially...
Apache Jetspeed Detection
Binary data apachejetspeeddetect.nbin...
Apache Jetspeed User Manager Service SQLi
The Apache Jetspeed application running on the remote host is affected by a SQL injection vulnerability in the User Manager service due to improper sanitization of user-supplied input to the 'user' and 'role' parameters. An unauthenticated, remote attacker can exploit this to inject SQL queries,...
Apache Jetspeed Cross-Site Scripting Vulnerability
Jetspeed is the United States Apache Apache Software Foundation of a set of open portal platform and enterprise information portal using Java and XML development. A cross-site scripting vulnerability exists in Jetspeed versions 2.2.0 through 2.2.2. The vulnerability can be exploited to inject...
Apache Jetspeed Cross-Site Scripting Vulnerability (CNVD-2016-01717)
Jetspeed is the United States Apache Apache Software Foundation of a set of open portal platform and enterprise information portal using Java and XML development. A cross-site scripting vulnerability exists in Jetspeed versions 2.2.0 through 2.2.2, which stems from the program allowing HTML tags ...
Apache Jetspeed 存储型跨站脚本漏洞
No description provided by source...
Apache Jetspeed跨站脚本漏洞
No description provided by source...
Portal Apache Jetspeed 2.3.0 and earlier versions: a remote code execution vulnerability analysis-vulnerability warning-the black bar safety net
! As my personal“friendship detect open source software security”one of the projects I'm ready to play play the Apache Jetspeed 2, which v2. 3 0 one. Jetspeed this stuff, used those words, that is: “An open portal platform and enterprise information portal, completely based on open standards,...
Apache Jetspeed User Management REST API Unauthorized Access Vulnerability
Jetspeed is based on Java and XML open source enterprise information portal implementation . Jetspeed can integrate a variety of data sources , through the XSL technology will be organized into a Jsp page data or Html page to the client ; Jetspeed also supports templates and content publishing...
Apache Jetspeed Directory Traversal Vulnerability
Jetspeed is based on Java and XML open source enterprise information portal implementation . Jetspeed can integrate a variety of data sources , through the XSL technology will be organized into a Jsp page data or Html page to the client ; Jetspeed also supports templates and content publishing...
Apache Jetspeed 目录穿越漏洞
通过管理员账号在后台 Portal Site Manger 处 import 恶意构造的 ZIP 文件,ZIP 压缩文件中包含名称为 ../../webapps/de.jsp 的文件,在后台处理 上传时会拼接此文件名导致目录穿越,控制文件上传路径。 poc.zip 包 含 名 为 ../../webapps/ROOT/de.jsp 的 文 件 , 内 容 为 is vulnerable: 上传后,即可在网站根目录根据目标环境决定访问到 de.jsp 文件: 要利用目录穿越上传任意文件虽然需要管理权限的账户,但是通过前一个漏 洞可以轻松创建一个拥有管理者权限的任意账户,再利用此漏洞上传...
Apache Jetspeed 用户管理 REST API 未授权访问漏洞
漏洞效果 用户管理 REST API 未授权 构造用户管理 REST API 创建用户 foobar: curl -i "http://192.168.199.152:8080/jetspeed/services/usermanager/users/?type=json&name=foobar&password=password&passwordconfirm=password&usernamegiven=foo&usernamefamily=bar&[email protected]&newrule=" -X POST 构造用户管理 REST API 提升用户 foobar...
Apache Jetspeed Arbitrary File Upload
This module exploits the unsecured User Manager REST API and a ZIP file path traversal in Apache Jetspeed-2, version 2.3.0 and unknown earlier versions, to upload and execute a shell. Note: this exploit will create, use, and then delete a new admin user. Warning: in testing, exploiting the file...
CVE-2006-0248
CVE-2006-0248 concerns Virata-EmWeb web server 6_1_0 used in Intracom JetSpeed 500/520 and Allied Data CopperJet 811 RouterPlus. The vulnerability allows remote attackers to access privileged information (e.g., user lists, configuration settings) via direct HTTP requests. The connected documents ...
CVE-2006-0248
Virata-EmWeb web server 610, as used in 1 Intracom JetSpeed 500 and 520 and 2 Allied Data Technologies CopperJet 811 RouterPlus, allows remote attackers to access privileged information, such as user lists and configuration settings, via direct HTTP requests...