2719 matches found
[SECURITY] Fedora 34 Update: jetty-9.4.40-1.fc34
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in ord er to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...
EulerOS 2.0 SP3 : velocity (EulerOS-SA-2021-1858)
According to the version of the velocity package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as...
[SECURITY] Fedora 32 Update: jetty-9.4.40-1.fc32
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in ord er to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...
[SECURITY] Fedora 33 Update: jetty-9.4.40-1.fc33
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in ord er to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...
org.smartboot.flow:smart-flow-admin (>=1.0.8 <=1.1.4), org.smartboot.servlet:smart-servlet-maven-plugin (>=0.1.9 <=0.6) +1 more potentially affected by CVE-2021-29425 via org.smartboot.servlet:servlet-core (>=0.1.9 <=0.6)
org.smartboot.servlet:servlet-core MAVEN version =0.1.9, =1.0.8, =0.1.9, =0.1.9, =0.6 Source cves: CVE-2021-29425 Source advisory: OSV:GHSA-GWRP-PVRQ-JMWV...
Vulnerability fixed in Tomcat
Two vulnerabilities have been discovered in the Tomcat servlet and the JSP engine, which could lead to information disclosure or denial of service. -= Debian =- Debian has made updates to tomcat9 available for Debian 10.0 Buster to address the vulnerabilities. You can install the custom packages ...
Debian DSA-4891-1 : tomcat9 - security update
Two vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in information disclosure or denial of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4891. The text itse...
Authorization
SAP NetWeaver AS JAVA Customer Usage Provisioning Servlet, versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet...
CVE-2021-27598
SAP NetWeaver AS JAVA Customer Usage Provisioning Servlet, versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet...
PT-2021-17534 · Sap · Sap Netweaver As Java
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS JAVA versions 7.31, 7.40, 7.50 Description: The issue allows an attacker to read statistical data, including product version, traffic, and timestamp, due to a missing authorization check in the Customer Usage Provisioning...
Updated velocity packages fix security vulnerability
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...
VulnCheck KEV: CVE-2019-0232
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by...
SAP NetWeaver AS Java Invoker Servlet Code Execution (1445998)
SAP Netweaver Application Server Java versions before 7.30 are potentially affected by a code execution vulnerability in the invoker servlet. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable Network Security,...
Authorization Before Parsing and Canonicalization in jetty
Release 9.4.37 introduced a more precise implementation of RFC3986 with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours. The default mode allowed %...
GHSA-V7FF-8WCX-GMC5 Authorization Before Parsing and Canonicalization in jetty
Release 9.4.37 introduced a more precise implementation of RFC3986 with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours. The default mode allowed %...
Information Disclosure
jetty-server is vulnerable to information disclosure. The URI normalisation in default compliance mode does not escape % encoded characters in the request metadata by common Servlet implementations, allowing access to sensitive resources within the WEB-INF directory via the use of URI with %2e or...
HPESBUX04114 rev.1 - HP-UX 11iv3 Tomcat-based Servlet Engine7.0.104.01. Multiple Remote Vulnerabilities
Potential Security Impact: Local: Denial of Service DoS, Disclosure of Privileged Information; Remote: Code Execution, Denial of Service DoS, Disclosure of Privileged Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX Tomcat-based Servlet v.7.x Engine D.7.0.104.01 a...
SAP Solution Manager remote unauthorized OS commands execution
This module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet tcsmdagentapplicationeem of SAP Solution Manager SolMan running version 7.2. The vulnerability occurs due to missing authentication checks when submitting a SOAP request to the /EemAdminService/EemAdmin page to get...
SAP Solution Manager 7.2 Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Solution Manager remote unauthorized OS commands execution', 'License' = MSFLICENSE, 'Author' = 'Yvan Genuer', @1ggy The researcher who...
