Caucho Resin 2.0/2.1 - Multiple HTML Injection and Cross-site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/8852/info It has been reported that Caucho Resin is prone to multiple HTML Injection and cross-site scripting vulnerabilities in various scripts that may allow a remote attacker to cause hostile HTML or script code to be...

万户网络技建站使用中间件Resin版本过低导致众多客户网站磁盘信息泄露

简要描述： 万户网络用来建站的中间件为，Resin-3.0.17版本，这个版本有个非常严重的信息泄露 漏洞 。具体详情请翻页。 漏洞介绍 ： 传送门 ：http://www.cnvd.org.cn/flaw/show/CNVD-2006-3233 详细说明： 万户主站：http://www.wanhu.com.cn/ 当然，我只是用来介绍下万户网络，主站木有这个漏洞。 下面请看案例 google hack： All Rights Reserved Designed by Wanhu inurl:jsp 不截图了 直接发有问题的网站。 http://www.ahdx.gov.cn/c:/...

Resin Application Server 4.0.36 - Source Code Disclosure

Resin Application Server 4.0.36 Source Code Disclosure Vulnerability Vendor: Caucho Technology, Inc. Product web page: http://www.caucho.com Affected version: Resin Professional Web And Application Server 4.0.36 Summary: Resin is the Java Application Server for high traffic sites that require spe...

Resin Application Server 4.0.36 - Source Code Disclosure

Resin Application Server 4.0.36 - Source Code Disclosure Resin Application Server 4.0.36 Source Code Disclosure Vulnerability Vendor: Caucho Technology, Inc. Product web page: http://www.caucho.com Affected version: Resin Professional Web And Application Server 4.0.36 Summary: Resin is the Java...

Caucho Resin <= 4.0.36 Information Disclosure Vulnerability - Active Check

Caucho Resin is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:caucho:resin";...

Resin Application Server 4.0.36 Source Code Disclosure

Resin Application Server 4.0.36 Source Code Disclosure Vulnerability Vendor: Caucho Technology, Inc. Product web page: http://www.caucho.com Affected version: Resin Professional Web And Application Server 4.0.36 Summary: Resin is the Java Application Server for high traffic sites that require spe...

Caucho Resin - resin-admin URI Cross-Site Scripting

Caucho Resin - resin-admin URI Cross-Site Scripting source: https://www.securityfocus.com/bid/60426/info Resin Professional is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitra...

Resin Application Server 4.0.36 Source Code Disclosure Vulnerability

Summary Resin is the Java Application Server for high traffic sites that require speed and scalability. It is one of the earliest Java Application Servers, and has stood the test of time due to engineering prowess. Description The vulnerability is caused do to an improper sanitization of the 'fil...

Resin Application Server 4.0.36 Cross-Site Scripting Vulnerabilities

Summary Resin is the Java Application Server for high traffic sites that require speed and scalability. It is one of the earliest Java Application Servers, and has stood the test of time due to engineering prowess. Description Resin Application and Web Server suffers from a XSS issue due to a...

Resin Application Server 4.0.36 Cross Site Scripting

Resin Application Server 4.0.36 Cross-Site Scripting Vulnerabilities Vendor: Caucho Technology, Inc. Product web page: http://www.caucho.com Affected version: Resin Professional Web And Application Server 4.0.36 Summary: Resin is the Java Application Server for high traffic sites that require...

Caucho Resin - '/resin-admin/' URI Cross-Site Scripting

source: https://www.securityfocus.com/bid/60426/info Resin Professional is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting use...

Caucho Resin - index.php?logout Cross-Site Scripting

Caucho Resin - index.php?logout Cross-Site Scripting source: https://www.securityfocus.com/bid/60426/info Resin Professional is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

Caucho Resin - 'index.php?logout' Cross-Site Scripting

source: https://www.securityfocus.com/bid/60426/info Resin Professional is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting use...

CVE-2012-2965

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue...

CVE-2012-2966

Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors...

CVE-2012-2969

Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filename extensions for created files via a %00 sequence in a pathname within an HTTP request...

CVE-2012-2967

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == equals sign equals sign operator for comparisons, which has unspecified impact and context-dependent attack vectors...

Code injection

Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors...

Design/Logic Flaw

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == equals sign equals sign operator for comparisons, which has unspecified impact and context-dependent attack vectors...

Design/Logic Flaw

Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue...