Debian DSA-3892-1 : tomcat7 - security update

Aniket Nandkishor Kulkarni discovered that in tomcat7, a servlet and JSP engine, static error pages used the original request's HTTP method to serve content, instead of systematically using the GET method. This could under certain conditions result in undesirable results, including the replacemen...

[SECURITY] [DSA 3891-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3891-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 22, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3891-1 (tomcat8 - security update)

Aniket Nandkishor Kulkarni discovered that in tomcat8, a servlet and JSP engine, static error pages used the original request OpenVAS Vulnerability Test $Id: deb3891.nasl 6607 2017-07-07 12:04:25Z cfischer $ Auto-generated from advisory DSA 3891-1 using nvtgen 1.0 Script version: 1.0 Author:...

tomcat: security manager bypass via JSP Servlet config parameters

It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

tomcat: security manager bypass via JSP Servlet config parameters

It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 7

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

SQL injection vulnerability in the typeId parameter of news_list.jsp file of Shangli K12 digital campus management platform.

Shangli K12 Digital Campus Management Platform is an integrated campus solution. A SQL injection vulnerability exists in the typeId parameter of the newslist.jsp file in the K12 digital campus management platform. The vulnerability is due to the system typeId parameter does not filter the data...

kmcollege.ac.in XSS vulnerability

Vulnerable URL: http://www.kmcollege.ac.in/viewgallery6.jsp?&=English%22%27--!%3E%3CScript%20/K/%3Econfirm'OPENBUGBOUNTY'%3C/Script%20/K/%3E&=1264 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

imaginaire.com XSS vulnerability

Vulnerable URL: http://www.imaginaire.com/indexv2.jsp?ordreDescAsc=ASC%22%27--!%3E%u003CSvg%20/%u3008Svg%20/%uFF1CSvg%20/Onload=confirmOPENBUGBOUNTY%20//cle=CANADIENS%20DE%20MONTREAL%20tuque=tous=in1descf=commencedate=datePI&cat1;=prix=prixPI=en&=/recherchev2/avance2.jsp=30 Details: Description|...

Fixed in Apache Tomcat 7.0.78

Important: Security Constraint Bypass CVE-2017-5664 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the...

Fixed in Apache Tomcat 8.0.44

Important: Security Constraint Bypass CVE-2017-5664 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the...

yageo.com XSS vulnerability

Vulnerable URL: http://www.yageo.com/NewPortal/en/search/search-2.jsp Details: Description| Value ---|--- Patched:| No Latest check for patch:| 07.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 449435 VIP website status:| No Check yageo.com SSL connection:|...

Fixed in Apache Tomcat 8.5.15

Important: Security Constraint Bypass CVE-2017-5664 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the...

SQL Injection Vulnerability in the id parameter of cmpp2.jsp file of Ecommerce's customer management platform

Enterprise letter is the use of java development of a special tailored to the enterprise customer value-added SMS business, enterprise customers in the use of computers at the same time can be completed with the production of office combined with the internal SMS communication. SQL injection...

SQL Injection Vulnerability in the Content Parameter of smsreportxiang.jsp File on ECS Customer Management Platform

Enterprise letter is the use of java development of a special tailored to the enterprise customer value-added SMS business, enterprise customers in the use of computers at the same time can be completed with the production of office combined with the internal SMS communication. SQL injection...

Debian DSA-3842-1 : tomcat7 - security update

Two vulnerabilities were discovered in tomcat7, a servlet and JSP engine. - CVE-2017-5647 Pipelined requests were processed incorrectly, which could result in some responses appearing to be sent for the wrong request. - CVE-2017-5648 Some application listeners calls were issued against the wrong...

Debian DSA-3843-1 : tomcat8 - security update

Two vulnerabilities were discovered in tomcat8, a servlet and JSP engine. - CVE-2017-5647 Pipelined requests were processed incorrectly, which could result in some responses appearing to be sent for the wrong request. - CVE-2017-5648 Some application listeners calls were issued against the wrong...

[SECURITY] [DSA 3843-1] tomcat8 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3843-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 03, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3842-1] tomcat7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3842-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 03, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3842-1 (tomcat7 - security update)

Two vulnerabilities were discovered in tomcat7, a servlet and JSP engine. CVE-2017-5647 Pipelined requests were processed incorrectly, which could result in some responses appearing to be sent for the wrong request. CVE-2017-5648 Some application listeners calls were issued against the wrong...