ACROS Security: Unsanitized Session ID Cookie Allows Modifying Server Response

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2004-10-14-3 ------------------------------------------------------------------------- ASPR 2004-10-14-3: Unsanitized Session ID Cookie Allows Modifying Serv...

ACROS Security: Session Fixation in JRun Management Console

=====BEGIN-ACROS-REPORT===== PUBLIC ========================================================================= ACROS Security Problem Report 2004-10-14-2 ------------------------------------------------------------------------- ASPR 2004-10-14-2: Session Fixation in JRun Management Console...

Macromedia JRun Server is vulnerable to buffer overflow

Overview A buffer overflow vulnerability exists in the Macromedia JRun web server that may allow an attacker to cause a denial-of-service condition. Description JRun is an application server that works with most popular web servers, such as Apache and IIS. The JRun web server is vulnerable to a...

Macromedia JRun Server insecurely generates and handles JSESSIONIDs

Overview A vulnerability exists in Macromedia JRun that may allow an attacker to gain access to an authenticated user's session. Description Macromedia JRun is an application server that works with most popular web servers such as Apache and IIS. Macromedia states that JRun is deployed at over...

Macromedia JRun Server is vulnerable to a cross-site scripting attack

Overview A cross-site scripting vulnerability exists in the Macromedia JRun Server Management Console that may allow an attacker to execute arbitrary code. Description JRun is an application server that works with most popular web servers such as Apache and IIS. Macromedia states that JRun is...

Macromedia JRun Server contains an information disclosure vulnerability

Overview An information disclosure vulnerability exists in the Macromedia JRun that may allow an attacker to view the source code of files in the web root directory. Description Macromedia JRun is an application server that works with most popular web servers such as Apache and IIS. Macromedia...

CVE-2004-0928

The Microsoft IIS Connector in JRun 4.0 and Macromedia ColdFusion MX 6.0, 6.1, and 6.1 J2EE allows remote attackers to bypass authentication and view source files, such as .asp, .pl, and .php files, via an HTTP request that ends in ";.cfm"...

[Full-Disclosure] iDEFENSE Security Advisory 09.29.04 - Macromedia JRun 4 mod_jrun Apache Module Buffer Overflow Vulnerability

Macromedia JRun 4 modjrun Apache Module Buffer Overflow Vulnerability iDEFENSE Security Advisory 09.29.04 www.idefense.com/application/poi/display?id=145&type=vulnerabilities September 29, 2004 I. BACKGROUND Macromedia JRun 4 is a full Java 2 Enterprise Edition J2EE compatible application server...

[SA12638] Macromedia JRun Server Multiple Vulnerabilities

TITLE: Macromedia JRun Server Multiple Vulnerabilities SECUNIA ADVISORY ID: SA12638 VERIFY ADVISORY: http://secunia.com/advisories/12638/ CRITICAL: Moderately critical IMPACT: Hijacking, Cross Site Scripting, Exposure of sensitive information, DoS WHERE: From remote SOFTWARE: Macromedia Jrun 4.x...

Macromedia JRun Multiple Vulnerabilities

Binary data 2316.prm...

JRun Multiple Vulnerabilities (OF, XSS, ID, Hijacking)

The remote host is running JRun, a J2EE application server running on top of IIS or Apache. There are multiple flaws in the remote version of this software : - The JSESSIONID variable is not implemented securely. An attacker may use this flaw to guess the session id number of other users. Only JR...

CVE-2004-1815

Unknown vulnerability in ColdFusion MX 6.0 and 6.1, and JRun 4.0, when a SOAP web service expects an array of objects as an argument, allows remote attackers to cause a denial of service memory consumption...

Multiple Vendor SOAP server (XML parser) attribute blowup DoS

/////////////////////////////////////////////////////////////////////////////// //========================== Security Advisory ==========================// ///////////////////////////////////////////////////////////////////////////////...

Macromedia JRun 4.0 build 61650 - Administrative Interface Multiple Cross-Site Scripting Vulnerabilities

Macromedia JRun 4.0 build 61650 - Administrative Interface Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/9112/info A number of cross-site scripting vulnerabilities have been reported for Macromedia Jrun, specifically in the administrative interface. The...

Macromedia JRun 4.0 build 61650 - Administrative Interface Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/9112/info A number of cross-site scripting vulnerabilities have been reported for Macromedia Jrun, specifically in the administrative interface. The problem is said to occur due to insufficient sanitization of URI parameters that may be passed to the page...

CVE-2002-0801

The CVE-2002-0801 issue affects Macromedia JRun 3.1 on Windows, where the ISAPI DLL filter for JRun is vulnerable to a buffer overflow via a long Host header in a request for a .jsp file. This allows a remote attacker to execute arbitrary code with SYSTEM privileges by sending a crafted request t...

CVE-2002-1025

JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed...

CVE-2002-1025

CVE-2002-1025 involves JRun 3.0–4.0. According to the description, remote attackers can read JSP source code by sending an encoded null byte in an HTTP GET request, causing the server to send the .JSP unparsed. The impact is partial confidentiality (read access) with no integrity/availability imp...

CVE-2002-0801

Buffer overflow in the ISAPI DLL filter for Macromedia JRun 3.1 allows remote attackers to execute arbitrary code via a direct request to the filter with a long HTTP host header field in a URL for a .jsp file...

CVE-2002-0665

CVE-2002-0665 : Macromedia JRun Administration Server has a login-bypass flaw where an extra slash in the URL allows remote attackers to bypass authentication. The entry is high severity (CVSS 2.0 base score 10.0, NETWORK attack vector, no authentication). Public technical details such as affecte...