CVE-2000-0684

BEA WebLogic 5.1.x is affected by an access restriction flaw in the JSPServlet. The vulnerability allows remote attackers to compile and execute Java JSP code by directly invoking the JSPServlet on any source file, enabling complete confidentiality and integrity compromise as described by the CVS...

CVE-2000-0497

IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case...

CVE-2000-0681

Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension...

CVE-2000-0681

CVE-2000-0681 describes a buffer overflow in the BEA WebLogic Server proxy plug-in that handles third‑party web server requests to forward JSP URLs. The flaw, triggered by long URL paths (notably with a .JSP extension), can overflow a buffer in wl_proxy and allow remote code execution as the user...

CVE-2000-0499

The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case...

CVE-2000-0497

The CVE-2000-0497 issue affects IBM WebSphere server 3.0.2, where a remote attacker can view the source code of a JSP program by requesting a URL that serves a JSP extension in upper case. The root cause is case-insensitive handling of JSP extensions, allowing source disclosure over the network. ...

CVE-2000-0540

The CVE-2000-0540 vulnerability affects Allaire/Macromedia JRun 2.3.x with its sample files. The issue enables remote disclosure of arbitrary files and configuration information, via JSP sample files (e.g., viewsource.jsp), constituting a partial confidentiality impact. Connected sources also ref...

CVE-2000-0499

BEA WebLogic 3.1.8–4.5.1 is affected. The default configuration allows a remote attacker to view the source code of a JSP program by requesting a URL that exposes the JSP extension in upper case. Root cause: default config enables exposing JSP source. Impact: confidentiality of JSP source could b...

CVE-2000-0497: Improper Handling of Case Sensitivity

IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case...

CVE-2000-0684: Undefined Security Weakness

BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file...

CVE-2000-0499: Improper Handling of Case Sensitivity

The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case...

CVE-2000-0540: Undefined Security Weakness

JSP sample files in Allaire JRun 2.3.x allow remote attackers to access arbitrary files e.g. via viewsource.jsp or obtain configuration information...

CVE-2000-0681: Undefined Security Weakness

Buffer overflow in BEA WebLogic server proxy plugin allows remote attackers to execute arbitrary commands via a long URL with a .JSP extension...

CVE-2000-0629

The default configuration of the Sun Java web server 2.0 and earlier allows remote attackers to execute arbitrary commands by uploading Java code to the server via board.html, then directly calling the JSP compiler servlet...

CVE-2000-0629: Undefined Security Weakness

The default configuration of the Sun Java web server 2.0 and earlier allows remote attackers to execute arbitrary commands by uploading Java code to the server via board.html, then directly calling the JSP compiler servlet...

FS-073100-10-BEA.txt

Foundstone, Inc. http://www.foundstone.com "Securing the Dot Com World" Security Advisory BEA's WebLogic .jsp/.jhtml remote command execution ---------------------------------------------------------------------- FS Advisory ID: FS-073100-10-BEA Release Date: July 31, 2000 Product: WebLogic Vendo...

BEA's WebLogic *.jsp/*.jhtml remote command execution

Foundstone, Inc. http://www.foundstone.com "Securing the Dot Com World" Security Advisory BEA's WebLogic .jsp/.jhtml remote command execution ---------------------------------------------------------------------- FS Advisory ID: FS-073100-10-BEA Release Date: July 31, 2000 Product: WebLogic Vendo...

tomcat-3.1.path.txt

LoWNOISE Tomcat 3.1 Path Revealing Problem. ====PRODUCT: Release Build 3.1 of Tomcat from Apache Software Foundation. Tomcat is the combined JSP 1.1 and Servlets 2.2 reference implementation being developed under the Apache process. http://jakarta.apache.org ====PROBLEM: Path Revealing Problem0...

Apache Tomcat 3.1 - Path Revealing

Apache Tomcat 3.1 - Path Revealing source: https://www.securityfocus.com/bid/1531/info A vulnerability exists in the JSP portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent JSP file, too much information is presented by the server as part o...

Apache Tomcat 3.1 - Path Revealing

source: https://www.securityfocus.com/bid/1531/info A vulnerability exists in the JSP portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent JSP file, too much information is presented by the server as part of the error message. This informati...