Apache Hadoop Jetty XSS

The version of Apache Hadoop running on the remote host has a cross- site scripting vulnerability. This is due to a bug in Jetty, the underlying web server. When Jetty displays a directory listing, arbitrary text can be inserted into the page. This affects all Hadoop components that use the Jetty...

Sybase Easerver 6.3 Directory Traversal

This module exploits a directory traversal vulnerability found in Sybase EAserver's Jetty webserver on port 8000. Code execution seems unlikely with EAserver's default configuration unless the web server allows WRITE permission. Module Options msf use auxiliary/scanner/http/sybase/easervertravers...

VMSA-2010-0012 : VMware vCenter Update Manager Fix for Jetty Web Server

The version of VMware vCenter Update Manager installed on the remote Windows host is 4.0 earlier than Update 3 or 4.1 earlier than Update 1. The installed version is, therefore, potentially affected by multiple vulnerabilities in the embedded Jetty Web server : - A directory traversal vulnerabili...

Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP)

This module logs in to an Axis2 Web Admin Module instance using a specific user/pass and uploads and executes commands via deploying a malicious web service by using SOAP. Module Options msf use exploit/multi/http/axis2/deployer msf undefineddeployer show actions ...actions... msf undefineddeploy...

Eclipse IDE | Help Server Local Cross Site Scripting (XSS) Vulnerability

========================================================= Eclipse IDE | Help Server Local Cross Site Scripting XSS Vulnerability ========================================================= 1. OVERVIEW The Help Content web application of Eclipse IDE was vulnerable to Cross Site Scripting XSS...

Eclipse IDE Cross Site Scripting

========================================================= Eclipse IDE | Help Server Local Cross Site Scripting XSS Vulnerability ========================================================= 1. OVERVIEW The Help Content web application of Eclipse IDE was vulnerable to Cross Site Scripting XSS...

VMware vCenter Update Manager XSS

The version of VMware vCenter Update Manager running on the remote host has a cross-site scripting vulnerability. This is due to a bug in Jetty, the underlying web server. When Jetty displays a directory listing, arbitrary text can be inserted into the page. A remote attacker could exploit this b...

VMware vCenter Update Manager fix for Jetty Web server addresses important security vulnerabilities

a. VMware vCenter Update Manager Jetty Web server vulnerabilities VMware vCenter Update Manager is an automated patch management solution for VMware ESX hosts and Microsoft virtual machines. Update Manager embeds the Jetty Web server which is a third party component. The default version of the...

VMSA-2010-0012:VMware vCenter Update Manager fix for Jetty Web server addresses HIGH security vulnerabilities

VMSA-2010-0012.2 VMware vCenter Update Manager fix for Jetty Web server addresses important security vulnerabilities VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2010-0012.2 VMware Security Advisory Synopsis: VMware vCenter Update Manager fix for Jetty Web server addresses...

Apache ActiveMQ XSS Vulnerability

Vulnerability Info: 26/04/2010 Issue Discovered 26/04/2010 Vendor Notified 27/04/2010 Vendor Conformed Class: Cross-Site Scripting Input validation Severity: Medium Overview: --------- Apache ActiveMQ is prone to cross-site scripting vulnerability. Technical Description: ---------------------- Th...

Apache ActiveMQ Cross Site Scripting

Vulnerability Info: 26/04/2010 Issue Discovered 26/04/2010 Vendor Notified 27/04/2010 Vendor Conformed Class: Cross-Site Scripting Input validation Severity: Medium Overview: --------- Apache ActiveMQ is prone to cross-site scripting vulnerability. Technical Description: ---------------------- Th...

Design/Logic Flaw

The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // slash slash initial substring in a URI for 1 admin/index.jsp, 2 admin/queues.jsp, or 3 admin/topics.jsp...

CVE-2010-1587

The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // slash slash initial substring in a URI for 1 admin/index.jsp, 2 admin/queues.jsp, or 3 admin/topics.jsp...

CVE-2010-1587

The CVE-2010-1587 issue affects Apache ActiveMQ with the Jetty ResourceHandler. It enables a remote attacker to disclose JSP source code by sending a URI beginning with // that targets (admin/index.jsp, admin/queues.jsp, or admin/topics.jsp). Affected products/versions are ActiveMQ 5.x before 5.3...

CVE-2010-1587

The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // slash slash initial substring in a URI for 1 admin/index.jsp, 2 admin/queues.jsp, or 3 admin/topics.jsp...

Apache ActiveMQ Double Slash Request Source Code Disclosure

The version of Apache ActiveMQ hosted on the remote web server is affected by a source code disclosure vulnerability in the Jetty ResourceHandler when handling requests to a JSP file with additional leading slashes. A remote attacker can exploit this to disclose the source code of pages, which ma...

Mort Bay Jetty 6.x <= 6.1.21 Multiple XSS Vulnerabilities - Active Check

Mort Bay Jetty is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mort Bay Jetty 6.0.0 - 7.0.0 Multiple Vulnerabilities - Active Check

Mort Bay Jetty is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty"; ifdescriptio...

CVE-2009-4610

Multiple cross-site scripting XSS vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or HTML via 1 the query string to jsp/dump.jsp in the JSP Dump feature, or the 2 Name or 3 Value parameter to the default URI for the Session Dump Servlet under...

CVE-2009-4612

Multiple cross-site scripting XSS vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under 1 jspsnoop/, 2 jspsnoop/ERROR/, and 3 jspsnoop/IOException/, and possibly t...