[Full-disclosure] Apache Tomcat 5.5.x remote Denial Of Service

Apache Tomcat is the famous servlet container for Java Servlet and JSP technologies released under ASL. Version 5.5.x is intented for servlet/jsp specification 2.4/2.0. More information on http://tomcat.apache.org/ Description: Many time consuming directory listing requests can cause a denial of...

Oracle 9iAS Jsp Source File Reading

In a default installation of Oracle 9iAS it is possible to read the source of JSP files. When a JSP is requested it is compiled 'on the fly' and the resulting HTML page is returned to the user. Oracle 9iAS uses a folder to hold the intermediate files during compilation. These files are created in...

Oracle Jserv Executes outside of doc_root

Detects Vulnerability in the execution of JSPs outside docroot. SPDX-FileCopyrightText: 2002 Michael Scheidell Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Tomcat 4.x JSP Source Exposure - Active Check

Tomcat 4.0.4 and 4.1.10 probably all other earlier versions also are vulnerable to source code exposure by using the default servlet org.apache.catalina.servlets.DefaultServlet. SPDX-FileCopyrightText: 2002 Felix Huber Some text descriptions might be excerpted from a referenced sources, and are...

WebLogic Server /%00/ bug

Requesting a URL with SPDX-FileCopyrightText: 2001 StrongHoldNet Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:weblogicserver"; ifdescription...

DeskNow Mail and Collaboration Server Directory Traversal Vulnerabilities

A directory traversal vulnerability was found in DeskNow webmail file attachment upload feature that may be exploited to upload files to arbitrary locations on the server. A second directory traversal vulnerability exists in the document repository file delete feature. SPDX-FileCopyrightText: 200...

Oracle 9i Application Server Jsp Source File Reading Information Disclosure Vulnerability - Active Check

In a default installation of Oracle 9i Application Server AS it is possible to read the source of JSP files. SPDX-FileCopyrightText: 2002 Matt Moore Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Apache Tomcat servlet/JSP container default files

The Apache Tomcat servlet/JSP container has default files installed. SPDX-FileCopyrightText: 2004 David Kyger Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat...

BEA WebLogic Scripts Server scripts Source Disclosure

BEA WebLogic may be tricked into revealing the source code of JSP scripts by using simple URL encoding of characters in the filename extension. e.g.: default.js%70 =default.jsp won SPDX-FileCopyrightText: 2001 INTRANODE Some text descriptions might be excerpted from a referenced sources, and are...

Oracle Jserv Executes outside of doc_root

Detects Vulnerability in the execution of JSPs outside docroot. A potential security vulnerability has been discovered in Oracle JSP releases 1.0.x through 1.1.1 in Apache/Jserv. This vulnerability permits access to and execution of unintended JSP files outside the docroot in Apache/Jserv. For...

[SA17164] Sun Java System Application Server JSP Source Code Disclosure

TITLE: Sun Java System Application Server JSP Source Code Disclosure SECUNIA ADVISORY ID: SA17164 VERIFY ADVISORY: http://secunia.com/advisories/17164/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information WHERE: From remote SOFTWARE: Sun Java System Application Server Sun ONE 7...

Sun Java System Application Server (Sun ONE) JSP source code disclosure

No description provided...

CVE-2002-2009

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by 1 +/, 2 /, 3 /, and 4 %20/, which leaks the pathname in an error message...

CVE-2001-1512

Summary of CVE-2001-1512 / CVE-2000-1050 cluster (Allaire JRun) Concrete details in connected docs show affected products as Allaire JRun 3.0 and 3.1. CVE-2000-1050 describes an information-disclosure/remote-access issue where the JRun HTTP servlet server can expose the WEB-INF directory via a cr...

CVE-2002-2007

The CVE-2002-2007 vulnerability affects Apache Tomcat 3.2.3 and 3.2.4, where remote attackers could obtain sensitive information (directory listings and web root path) via erroneous HTTP requests to JSP-related paths (test/jsp, samples/jsp, examples/jsp) or the test/realPath.jsp servlet, leaking ...

CVE-2002-2007

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages JSP in the 1 test/jsp, 2 samples/jsp and 3 examples/jsp directories, or the 4...

CVE-2002-2009

Affected software: Apache Tomcat 4.0.1. Vulnerability: Information disclosure where remote attackers can obtain the web root/pathname by triggering error pages for JSP requests that use a leading sequence (+/, >/,

CVE-2005-1836

CVE-2005-1836 affects NEXTWEB (i)Site. The vulnerability allows remote attackers to cause a denial of service (HTTP 500) by sending a crafted request, potentially involving wildcard requests for .jsp files. The description, sources, and CVE listings confirm the impact is a partial availability de...

CVE-2005-1836

NEXTWEB iSite allows remote attackers to cause a denial of service error 500 via a crafted HTTP request, possibly involving wildcard requests for .jsp files...

CVE-2005-1836

NEXTWEB iSite allows remote attackers to cause a denial of service error 500 via a crafted HTTP request, possibly involving wildcard requests for .jsp files...