3078 matches found
RedHat Update for tomcat RHSA-2015:0983-01
The remote host is missing an update for the Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2015-2994
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/userphoto/...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Websense TRITON 7.8 Source Code Disclosure
The version of Websense TRITON running on the remote web server contains a flaw in handling a JSP script request having an appended double quote character. This causes the source code of the script to be returned instead of it being executed. An unauthenticated, remote attacker can exploit this...
WSO2 Identity Server /carbon/user/add-finish.jsp User Cross-Site Request Forgery Vulnerability
WSO2 Identity Server is an open source identity services , support for Information Cards, OpenID and XACML. WSO2 Identity Server /carbon/user/add-finish.jsp has a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, entice users to parse them, and...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
tomcat6 security update
CentOS Errata and Security Advisory CESA-2015:0991 Updated tomcat6 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base...
Moderate: Red Hat Security Advisory: tomcat6 security and bug fix update
Updated tomcat6 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Novell ZENworks Configuration Management < 11.3.2 Remote Code Execution (intrusive check)
The version of Novell ZENworks Configuration Management ZCM running on the remote host is affected by a remote code execution vulnerability due to improper sanitization of user-supplied input to the 'uid' POST parameter in the /zenworks/UploadServlet script. An unauthenticated, remote attacker ca...
Graudit - Find potential security flaws in source code using grep
Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being very...
CVE-2015-0113
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next...
CVE-2015-0113
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next...
用友致远A6协同系统敏感信息泄露&SQL注射
简要描述： 用友致远A6协同系统敏感信息泄露&SQL注射，union可shell 详细说明： 1重置数据库账号密码漏洞 /yyoa/ext/byoa/start.jsp 该文件的代码为： 可以看出该文件没有验证任何权限，便进行了重置数据库用户byoa的密码为： byoa 2 mysql+jsp注射 /yyoa/ext/trafaxserver/ExtnoManage/isNotInTable.jsp 测试方法 http://www.ssepec.net/yyoa/ext/trafaxserver/ExtnoManage/isNotInTable.jsp?userids=17 union...
The Spring Framework tags EL expressions to perform vulnerability analysis CVE-2 0 1 1-2 7 3 0-a vulnerability warning-the black bar safety net
0x00 Preface This vulnerability has been out for a long time, the previous simple analysis, but due to time constraints, no in-depth study of principles, the online on this vulnerability analysis is also not too much recently due to work reasons, in-depth analysis about the vulnerability of the...
JBoss Seam 2 - Arbitrary File Upload / Execution (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/proto/http' require 'msf/core' class Metasploit3 'JBoss Seam 2 File Upload and Execute', 'Description' = %q Versions of the JBoss Seam 2 framework 'vulp1n3...
JBoss Seam 2 File Upload / Remote Code Execute Exploit
Versions of the JBoss Seam 2 framework prior to 2.2.1CR2 fail to properly sanitize inputs to some JBoss Expression Language expressions. As a result, attackers can gain remote code execution through the application server. This Metasploit module leverages RCE to upload and execute a meterpreter...
Tomcat/JBossWeb: XML parser hijack by malicious web application
It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...
ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)
The version of ManageEngine Desktop Central running on the remote host is affected by a remote code execution vulnerability due to a failure by the statusUpdate script to properly sanitize user-supplied input to the 'fileName' parameter when performing an 'LFU' action to statusUpdate. A remote,...