JVN#88408929: Apache Struts vulnerable to cross-site scripting

Apache Struts provided by the Apache Software Foundation is a software framework for creating web applications in Java. Apache Struts is vulnerable to cross-site scripting when JSP files can be accessed directly. Impact An arbitrary script may be executed on the user's Internet Explorer when the...

Important: Red Hat Security Advisory: jakarta-taglibs-standard security update

Updated jakarta-taglibs-standard packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Directory traversal

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors...

CVE-2015-1830

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors...

CVE-2015-1830

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors...

CVE-2015-1830

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors...

Apache ActiveMQ 5.11.1/5.13.2 - Directory Traversal / Command Execution

I have recently been playing with Apache ActiveMQ, and came across a simple but interesting directory traversal flaw in the fileserver upload/download functionality. I have only been able to reproduce this on Windows, i.e. where "" is a path delimiter. An attacker could use this flaw to upload...

elkgrovechamber.chambermaster.com XSS vulnerability

Vulnerable URL: http://elkgrovechamber.chambermaster.com/directory/jsp/busdir/SearchResults.jsp Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 13:56 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / N...

File Upload Vulnerability in Wando OA System

Wando Ezoffice system is a set of jsp-based oa system , the system is based on J2EE architecture technology of three-tier architecture , completely B / S architecture , widely used in various industries . Wando Ezoffice collaborative office platform there is a file upload vulnerability in...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

jcrew.com XSS vulnerability

Vulnerable URL: https://www.jcrew.com/be/womenscategory/shoes/espadrilles/PRDO"VRC5447/C5447.jsp Details: Description| Value ---|--- Patched:| Yes, at 07.11.2016 Latest check for patch:| 07.11.2016 04:41 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1611 Googl...

jcrew.com XSS vulnerability

Vulnerable URL: https://www.jcrew.com/id/womenscategory/shoes/espadrilles/PRDO"VRC5447/C5447.jsp Details: Description| Value ---|--- Patched:| Yes, at 07.11.2016 Latest check for patch:| 07.11.2016 04:35 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1611 Googl...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

SQL injection vulnerability in netrep/index.jsp parameter of financial statement system of Beijing Jiuji Software Co.

Financial Statement System is a financial bookkeeping system. A SQL injection vulnerability exists in the netrep/index.jsp parameter of the financial statement system of Beijing Jiuqi Software Co. Ltd. that allows an attacker to exploit the vulnerability to obtain sensitive information from the...

ManageEngine EventLog Analyzer Remote Code Execution

This module exploits a SQL query functionality in ManageEngine EventLog Analyzer v10.6 build 10060 and previous versions. Every authenticated user, including the default "guest" account can execute SQL queries directly on the underlying Postgres database server. The queries are executed as the...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

SearchBlox Reflective Cross-Site Scripting Vulnerability

SearchBlox is an enterprise search solution built on Lucene. SearchBlox suffers from a reflected cross-site scripting vulnerability. Because input passed to the "/searchblox/admin/main.jsp" script via the "menu2" HTTP GET parameter is not properly filtered before being returned to the user, a...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...