Design/Logic Flaw

VMware vFabric tc Server aka SpringSource tc Server 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored passwords...

CVE-2011-0527

VMware vFabric tc Server aka SpringSource tc Server 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored passwords...

CVE-2011-0527

This CVE affects VMware vFabric tc Server (SpringSource tc Server) 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE. The JMX authentication password handling allows use of both plain text and obfuscated passwords, enabling context-dependent attackers with read access to stored passwords ...

CVE-2011-0527: Improper Authentication

VMware vFabric tc Server aka SpringSource tc Server 2.0.x before 2.0.6.RELEASE and 2.1.x before 2.1.2.RELEASE accepts obfuscated passwords during JMX authentication, which makes it easier for context-dependent attackers to obtain access by leveraging an ability to read stored passwords...

PT-2011-2423

Name of the Vulnerable Software and Affected Versions VMware vFabric tc Server versions 2.0.x through 2.0.5.RELEASE VMware vFabric tc Server versions 2.1.x through 2.1.1.RELEASE Description The issue allows context-dependent attackers to obtain access more easily by leveraging the ability to read...

Apache Tomcat "MemoryUserDatabase"信息泄露漏洞

BUGTRAQ ID: 48456 Tomcat是由Apache软件基金会下属的Jakarta项目开发的一个Servlet容器，按照Sun Microsystems提供的技术规范，实现了对Servlet和JavaServer Page（JSP）的支持，并提供了作为Web服务器的一些特有功能。 Apache Tomcat在MemoryUserDatabase的实现上存在信息泄露漏洞，远程攻击者可利用此漏洞获取敏感信息。 此漏洞源于在通过使用MemoryUserDatabase的JMX创建用户时存在的错误。如果出现意外，可导致用创建的用户密码登陆Tomcat。 Apache Group...

CVE-2011-2204

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

CVE-2011-2204

Removed by vendor...

CVE-2011-2204: Exposure of Sensitive Information to an Unauthorized Actor

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

CVE-2011-2204

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

PT-2011-3680

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.33 Apache Tomcat versions 6.x through 6.0.32 Apache Tomcat versions 7.x through 7.0.18 Description The issue allows local users to obtain sensitive information by reading a log file when the...

For JBoss vulnerability to obtain Webshell-vulnerability warning-the black bar safety net

JBoss is a large application platform, ordinary users is difficult to come into contact with. The more difficult to contact something the more I advanced, to borrow a Beijing bus driver Lee su Li of the word“force can only dry out the incompetent, hard to dry out outstanding”, in security is also...

Nmap NSE net: rmi-dumpregistry

Connects to a remote RMI registry and attempts to dump all of its objects. First it tries to determine the names of all objects bound in the registry, and then it tries to determine information about the objects, such as the the class names of the superclasses and interfaces. This may, depending ...

VulnCheck KEV: CVE-2010-0738

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method...

PostgreSQL Plus Advanced Server DBA Management Server Remote Authentication Bypass Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Postgres Plus Advanced Server DBA Management Server. Authentication is not required to exploit this vulnerability. The flaw exists within the DBA Management Server component which listens by defaul...

JBoss JMX - Console Beanshell Deployer WAR Upload and Deployment (Metasploit)

$Id: jbossbshdeployer.rb 11533 2011-01-10 14:34:24Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3 before 4.3.0.CP09 allows remote attackers to hijack the authentication of administrators for requests that deploy WAR files...

CVE-2010-3878

Cross-site request forgery CSRF vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3 before 4.3.0.CP09 allows remote attackers to hijack the authentication of administrators for requests that deploy WAR files...

CVE-2010-3878

Cross-site request forgery CSRF vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3 before 4.3.0.CP09 allows remote attackers to hijack the authentication of administrators for requests that deploy WAR files...

CVE-2010-3878: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the JMX Console in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.3 before 4.3.0.CP09 allows remote attackers to hijack the authentication of administrators for requests that deploy WAR files...