CVE-2018-1917

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an authenticated user to access JSP files and disclose sensitive information. IBM X-Force ID: 152784...

CVE-2018-1917

IBM InfoSphere Information Server versions 11.3, 11.5, and 11.7 are affected by CVE-2018-1917, an information-disclosure flaw that could allow an authenticated user to access JSP files and disclose sensitive information. IBM’s security bulletin provides remediation by upgrading to 11.7.1.0 (and r...

Cross-Site Scripting (XSS)

Apache Tomcat is vulnerable to Cross-site scripting. An attacker is able to inject arbitrary Javascript into a user's browser by sending a malicious code via a request for a .JSP file, which will be executed on the victim's browser when the error message is rendered...

Cross-Site Scripting (XSS)

Mort Bay Jetty is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary web script or HTML via the query string to jsp/dump.jsp in the JSP Dump feature, the Name and Value parameter in the default URI for the Session Dump Servlet under session/...

Cross-Site Scripting (XSS)

Apache Tomcat is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the time parameter in cal2.jsp to steal session tokens or perform unwanted actions on behalf of the user...

Remote Code Execution

tomcat-catalina is vulnerable to remote code execution. With HTTP PUTs enabled, it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server...

OpenKM 6.3.2 < 6.3.7 - Remote Command Execution Exploit #RCE

Exploit for jsp platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenKM Document Management %q Versions of the OpenKM Document Management 'AkkuS ' ,...

OpenKM 6.3.2 6.3.7 - Remote Command Execution (Metasploit)

OpenKM 6.3.2 6.3.7 - Remote Command Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenKM Document Management %q Versions of the OpenKM Document Management 'AkkuS ' ,...

OpenKM Document Management Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenKM Document Management %q Versions of the OpenKM Document Management 'AkkuS ' , Vulnerability Discovery, PoC & Msf Module 'References' = 'URL'...

OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenKM Document Management %q Versions of the OpenKM Document Management 'AkkuS ' , Vulnerability Discovery, PoC & Msf Module 'References' = 'URL'...

CVE-2019-9632

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request...

OFCMS backend ueditor uploadFile file upload vulnerability

OFCMS is a content management system based on Java technology. A backend ueditor uploadFile file upload vulnerability exists in versions of OFCMS prior to 1.1.3. The vulnerability stems from the blocking of .jsp and .jspx files that fails to take into account file.jsp::$DATA of the...

OFCMS backend ueditor uploadScrawl file upload vulnerability

OFCMS is a content management system based on Java technology. A backend ueditor uploadScrawl file upload vulnerability exists in versions of OFCMS prior to 1.1.3. The vulnerability stems from the blocking of .jsp and .jspx files that fails to take into account the file.jsp::$DATA of the...

OFCMS backend ueditor uploadVideo file upload vulnerability

OFCMS is a content management system based on Java technology. A backend ueditor uploadVideo file upload vulnerability exists in versions of OFCMS prior to 1.1.3. The vulnerability stems from the blocking of .jsp and .jspx files that fails to take into account file.jsp::$DATA in the...

Code injection

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadVideo URI...

Code injection

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/comn/service/editUploadImage URI...

CVE-2019-9616

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadScrawl URI...

CVE-2019-9613

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadVideo URI...

ZOHO ManageEngine Netflow Analyzer Cross-Site Scripting Vulnerability (CNVD-2019-32076)

ZOHO ManageEngine Netflow Analyzer is a set of Web-based bandwidth monitoring tools from ZOHO. The product is mainly used for bandwidth monitoring and traffic analysis. A cross-site scripting vulnerability exists in the /netflow/jspui/popup1.jsp file in ZOHO ManageEngine Netflow Analyzer...

JSP Web Shell Generic Backdoor

An attacker might upload a web shell backdoor to a JSP server. A successful exploitation might allow the attacker to run arbitrary code, or use the server as a bot for further attacks...