265 matches found
JRun SSI Request Body Parsing
Vulnerable Products: JRun Java application server from Allaire. All current versions with latest security patches as of November 2001 are believed to be affected, including 2.3.3, 3.0, and 3.1. Impact: Revealing of source code to Java Server Pages, and other protected files inside the web root...
CVE-2001-0926
SSIFilter in Allaire JRun 3.1, 3.0 and 2.3.3 allows remote attackers to obtain source code for Java server pages .jsp and other files in the web root via an HTTP request for a non-existent SSI page, in which the request's body has an include statement...
Allaire JRun Java Application Server vulnerable to Cross-Site Scripting via passing of user input directly to default error page
Overview Web Servers that use the Allaire JRun Java Servlet Container are vulnerable to a cross-site scripting vulnerability. A web site may inadvertently include malicious HTML tags or scriptJavaScript, VBScript, Java, etc. in a dynamically generated page based on unvalidated input from...
Multiple Vendor Java Servlet Container Cross-Site Scripting Vulnerability
Multiple Vendor Java Servlet Container Cross-Site Scripting Vulnerability ========================================================================= Affected products: ================= Tomcat 3.2.1, 3.2.2-beta, 4.0-beta http://jakarta.apache.org/tomcat/ JRun 3.0...
CVE-2001-1084
Cross-site scripting vulnerability in Allaire JRun 3.0 and 2.3.3 allows a malicious webmaster to embed Javascript in a request for a .JSP, .shtml, .jsp10, .jrun, or .thtml file that does not exist, which causes the Javascript to be inserted into an error message...
CVE-2001-0179
Allaire JRun 3.0 is affected by an information-disclosure vulnerability where remote attackers can list the contents of WEB-INF and the web.xml in WEB-INF via a malformed URL containing a dot. This is described in the CVE record and corroborated by OpenVAS information-disclosure entries referenci...
CVE-2001-0179
Allaire JRun 3.0 allows remote attackers to list contents of the WEB-INF directory, and the web.xml file in the WEB-INF directory, via a malformed URL that contains a "."...
CVE-2001-0179
Allaire JRun 3.0 allows remote attackers to list contents of the WEB-INF directory, and the web.xml file in the WEB-INF directory, via a malformed URL that contains a "."...
Allaire JRun Crafted Request Forced Directory Listing
The version of Allaire JRun running on the remote host is affected by an information disclosure vulnerability. An unauthenticated, remote attacker can exploit this, by using a crafted URL request with '/./' prepended, to display a listing of a remote directory, even if a valid index file exists i...
Дырка в JRUN (WEB-INF reading)
Можно получить содержимое каталога WEB-INF и доступ к отдельным файлам...
Многочисленные дырки в JRUN
Атакующий имеет возможность перезаписать файлы на сервере, выполнить код на сервере и получить доступ к служебным файлам...
Security Bulletin (ASB01-02) JRun 3.0
Allaire posted the following security bulletin to their site recently. The online version can be found at: http://www.allaire.com/handlers/index.cfm?ID=19546&Method=Full ------------------------------------ Allaire Security Bulletin ASB01-02 JRun 3.0: Patch available for JRun malformed URI WEB-IN...
CVE-2000-1051
CVE-2000-1051 describes a directory traversal vulnerability in Allaire JRun 2.3 server where an attacker can read arbitrary files via the SSIFilter servlet. Affected software is Allaire JRun 2.3 server; the underlying flaw is in the SSIFilter servlet handling that allows path traversal. The NVD m...
CVE-2000-1049
CVE-2000-1049 affects Allaire JRun 3.0 HTTP servlet server. The vulnerability allows remote denial of service when a URL containing a long sequence of "." characters is processed. The available sources describe the impact as a DoS, but do not provide concrete exploitation details, affected versio...
CVE-2000-1049
Allaire JRun 3.0 http servlet server allows remote attackers to cause a denial of service via a URL that contains a long string of "." characters...
CVE-2000-1051
Directory traversal vulnerability in Allaire JRun 2.3 server allows remote attackers to read arbitrary files via the SSIFilter servlet...
CVE-2000-1050
Allaire JRun 3.0 http servlet server allows remote attackers to directly access the WEB-INF directory via a URL request that contains an extra "/" in the beginning of the request aka the "extra leading slash"...
CVE-2000-1050
The CVE-2000-1050 entry concerns Allaire JRun 3.0/3.1-era HTTP servlet servers where an information-disclosure vulnerability allows remote attackers to access WEB-INF (and related) directories. The root cause is an information-disclosure path handling flaw triggered by a URL request that contains...