Fixed in Apache Tomcat 6.0.44

Low: Denial of Service CVE-2014-0230 When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the...

tomcat -- multiple vulnerabilities

Apache Software Foundation reports: Low: Denial of Service CVE-2014-0230 When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be...

F5 BIG-IP Application Security Manager JSON Content Handling ASM Filter Bypass Vulnerability

F5 BIG-IP is the application switch. The F5 BIG-IP Application Security Manager ASM JSON parser fails to properly filter URL-encoded content, allowing remote attackers to exploit a vulnerability to bypass security filters...

CVE-2015-3435

Samsung Security Manager SSM before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP 1 PUT or 2 MOVE request...

Design/Logic Flaw

Samsung Security Manager SSM before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP 1 PUT or 2 MOVE request...

CVE-2015-3435

Samsung Security Manager SSM before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP 1 PUT or 2 MOVE request...

CVE-2015-3435

CVE-2015-3435 affects Samsung Security Manager (SSM) prior to 1.31. The vulnerability allows remote attackers to upload a file via HTTP PUT or HTTP MOVE, leading to arbitrary code execution on the server. Multiple sources describe the impact as remote code execution with SYSTEM privileges, effect...

Samsung Security Manager ActiveMQ Broker Service Remote Code Execution Vulnerability

Samsung Security Manager SSM is the central management platform for a set of recording devices. A remote code execution vulnerability in the ActiveMQ Broker service of SSM allows remote attackers to create arbitrary files on the server and execute arbitrary code with SYSTEM user privileges by...

Samsung Security Manager ActiveMQ Broker Service PUT Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. Successful exploitation allows an attacker to gain complete control of the system on which the product is...

SolarWinds Firewall Security Manager 6.6.5 - Client Session Handling (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability", 'Description' = %q This module exploits multiple...

Solarwinds Firewall Security Manager 6.6.5 Client Session Handling

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability", 'Description' = %q This module exploits multiple...

SolarWinds Firewall Security Manager userlogin.jsp Policy Bypass (CVE-2015-2284)

A policy bypass vulnerability exists in SolarWinds Firewall Security Manager. The vulnerability is due to a design weakness in the userlogin.jsp page which sets the "username" session value to a user supplied value prior to authentication. A remote unauthenticated attacker could exploit this...

IBM Security Identity Manager Information Disclosure Vulnerability (CNVD-2015-01982)

IBM Security Identity Manager is part of the IBM Security Systems portfolio of products that help organizations drive effective identity management and control across the enterprise, reducing the risk of identity fraud and improving regulatory compliance. An information disclosure vulnerability...

Validator: JSM bypass via ReflectionHelper

It was discovered that the implementation of org.hibernate.validator.util.ReflectionHelper together with the permissions required to run Hibernate Validator under the Java Security Manager could allow a malicious application deployed in the same application container to execute several actions wi...

Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

CVE-2015-2284

userlogin.jsp in SolarWinds Firewall Security Manager FSM before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling...

Session fixation

userlogin.jsp in SolarWinds Firewall Security Manager FSM before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling...

CVE-2015-2284

userlogin.jsp in SolarWinds Firewall Security Manager FSM before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling...

CVE-2015-2284

CVE-2015-2284 affects SolarWinds Firewall Security Manager (FSM) prior to version 6.6.5 HotFix1, with a vulnerability in userlogin.jsp that enables an unauthenticated remote attacker to gain privileges and execute arbitrary code via a client session handling flaw. The linked sources indicate mult...

Cisco Prime Security Manager Network Time Protocol Daemon (ntpd) Multiple Vulnerabilities (cisco-sa-20141222-ntpd)

According to its self-reported version number, the version of Cisco Prime Security Manager running on the remote host is prior to 9.3.3.2. It is, therefore, affected by multiple vulnerabilities in the bundled NTP libraries : - A security weakness exists due to the configauth function improperly...