CVE-2015-7818: Undefined Security Weakness

The administration-panel web service in IBM System Networking Switch Center SNSC before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file...

PT-2015-7662

Name of the Vulnerable Software and Affected Versions Infinite Automation Mango Automation versions 2.5.x through 2.6.x before 2.6.0 build 430 Description The issue allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file, specifically throu...

Allaire JRun 2.3 Arbitrary Code Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1831/info Jrun contains a vulnerability that allows a user to compile and execute JSP code from an arbitrary file on the webserver's filesystem. This bug is due to the way JSP execution is invoked -- if a requested...

CVE-2013-5534: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the attachment service in the Voice Message Web Service aka VMWS or Cisco Unity Web Service in Cisco Unity Connection allows remote authenticated users to create files, and consequently execute arbitrary JSP code, via a crafted pathname for a file that is not ...

PT-2013-5615

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection affected versions not specified Description A directory traversal issue in the attachment service of the Voice Message Web Service allows remote authenticated users to create files and execute arbitrary JSP code by...

VMware vCenter - Chargeback Manager ImageUploadServlet Arbitrary File Upload (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 /Apache.Win32/ include...

PT-2012-4658

Name of the Vulnerable Software and Affected Versions AutoFORM PDM Archive versions prior to 7.0 Description The issue allows remote authenticated users to bypass intended access restrictions via the "/jmx-console" API endpoint, and then upload and execute arbitrary JSP code via a JBoss...

CVE-2012-2561

HP Business Service Management BSM 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444...

PT-2012-4102

Name of the Vulnerable Software and Affected Versions HP Business Service Management BSM version 9.12 Description The issue allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component. This is achieved by uploading crafted .war files due to improper...

PT-2011-1521

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware versions 2.0.1.0 through 2.0.1.3 Description The issue affects confidentiality, integrity, and availability. It is related to the handling of null bytes in the evaluation parameter used in a filename, potentially...

Allaire JRun 2.3 - Arbitrary Code Execution

source: https://www.securityfocus.com/bid/1831/info Jrun contains a vulnerability that allows a user to compile and execute JSP code from an arbitrary file on the webserver's filesystem. This bug is due to the way JSP execution is invoked -- if a requested filename/path is prefixed with...