1487 matches found
Huawei Document Security Manager Information Disclosure Vulnerability
Huawei Document Security Manager is a set of document rights management software from Huawei in China. A vulnerability exists in Huawei Document Security Manager that can be exploited by remote attackers to obtain sensitive information...
Apache Tomcat Security Manager Security Restriction Bypass Vulnerability
Apache Tomcat is a popular open source JSP application server program. Apache Tomcat Security Manager in the ResourceLinkFactory.setGlobalContext public method implementation of a security restriction bypass vulnerability, an attacker through a malicious web application to inject the global...
Apache Tomcat Security Manager Bypass Vulnerability (Feb 2016) - Linux
Apache Tomcat is prone to a security manager bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...
Apache Tomcat SecurityManager Bypass Vulnerability - 01 (Feb 2016) - Linux
Apache Tomcat is prone to a SecurityManager bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat";...
Apache Tomcat SecurityManager Bypass Vulnerability (Feb 2016) - Windows
Apache Tomcat is prone to a SecurityManager bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat";...
Apache Tomcat Security Manager Bypass Vulnerability - 01 (Feb 2016) - Windows
Apache Tomcat is prone to a security manager bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...
Apache Tomcat Security Manager Remote Code Execution Vulnerability
Apache Tomcat is a popular open source JSP application server program. Apache Tomcat Security Manager suffers from a security restriction bypass vulnerability in the implementation of the session persistence mechanism that allows an attacker to place constructed objects in a session, which can be...
Apache Tomcat Security Manager Information Disclosure Vulnerability
Apache Tomcat is a popular open source JSP application server program. Apache Tomcat Security Manager has an information disclosure vulnerability in the implementation of the StatusManagerServlet, which allows attackers to exploit this vulnerability to obtain sensitive information...
UBUNTU-CVE-2016-0714
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privilege...
UBUNTU-CVE-2016-0763
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass...
HP Client Security Manager Cross-Site Scripting Vulnerability
HP Client Security Manager is a security manager product from Hewlett-Packard HP in the United States. The product provides features such as enhanced Windows logon and single sign-on for Web sites. A cross-site scripting vulnerability exists in HP Client Security Manager that originates from the...
tomcat -- multiple vulnerabilities
Mark Thomas reports: CVE-2015-5346 Apache Tomcat Session fixation CVE-2015-5351 Apache Tomcat CSRF token leak CVE-2016-0763 Apache Tomcat Security Manager Bypass...
tomcat -- multiple vulnerabilities
Mark Thomas reports: CVE-2015-5345 Apache Tomcat Directory disclosure CVE-2016-0706 Apache Tomcat Security Manager bypass CVE-2016-0714 Apache Tomcat Security Manager Bypass...
Fixed in Apache Tomcat 7.0.68
Low: Directory disclosure CVE-2015-5345 When accessing a directory protected by a security constraint with a URL that did not end in a slash, Tomcat would redirect to the URL with the trailing slash thereby confirming the presence of the directory before processing the security constraint. It was...
Fixed in Apache Tomcat 6.0.45
Low: Limited directory traversal CVE-2015-5174 This issue only affects users running untrusted web applications under a security manager. When accessing resources via the ServletContext methods getResource getResourceAsStream and getResourcePaths the paths should be limited to the current web...
Fixed in Apache Tomcat 8.0.32
Note: The issues below were fixed in Apache Tomcat 8.0.31 but the release vote for the 8.0.31 release candidate did not pass. Therefore, although users must download 8.0.32 to obtain a version that includes fixes for these issues, version 8.0.31 is not included in the list of affected versions...
CVE-2016-1301
The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1112 and Cisco Prime Security Manager PRSM software before 9.3.1.1112 allows remote authenticated users to change arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuo94842...
CVE-2016-1301
The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1112 and Cisco Prime Security Manager PRSM software before 9.3.1.1112 allows remote authenticated users to change arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuo94842...
Design/Logic Flaw
The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1112 and Cisco Prime Security Manager PRSM software before 9.3.1.1112 allows remote authenticated users to change arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuo94842...
