CentOS Update for tomcat6 CESA-2016:0492 centos6

Check the version of tomcat6 SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882434";...

Debian: Security Advisory (DSA-3530-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 6 : tomcat6 (CESA-2016:0492)

Updated tomcat6 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

TRS(ids新老版本)设计缺陷(xxe/用户信息泄露包括密码等)

简要描述： TRSids设计缺陷xxe/用户信息泄露包括密码，好久没有发过漏洞了，突然上来看了看，发现漏洞提交页面都变了 详细说明： 首先我们看看web.xml配置文件: ServiceServlet com.trs.idm.admin.service.ServiceServlet ServiceServlet /service 跟进ServiceServlet protected void serviceHttpServletRequest request, HttpServletResponse response throws ServletException, IOExceptio...

用友IUFO远程命令执行(cloudeye演示)

简要描述： 用友IUFO远程命令执行 详细说明： google:inurl:/service/iufo 这个只是其中的一条线索，当然这个已经搜出来10几页以上的站点 应用的使用量比较大，部署采用WebSphere 代码分析: web.xml: NCInvokerServlet nc.bs.framework.server.InvokerServlet NCFindWebServlet nc.bs.framework.server.FindWebResourceServlet NCFindWebServlet /NCFindWeb CommonServletDispatcher...

tomcat6 security update

CentOS Errata and Security Advisory CESA-2016:0492 Updated tomcat6 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base...

RedHat Update for tomcat6 RHSA-2016:0492-01

The remote host is missing an update for the Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

RHEL 6 : tomcat6 (RHSA-2016:0492)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0492 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. It was found that the expression language resolver...

Moderate: Red Hat Security Advisory: tomcat6 security and bug fix update

Updated tomcat6 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

jenkins: Local file inclusion vulnerability (SECURITY-195)

Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/...

Wildfly - WEB-INF META-INF Information Disclosure via Filter Restriction Bypass

Wildfly - WEB-INF META-INF Information Disclosure via Filter Restriction Bypass Exploit Title: Wildfly: WEB-INF and META-INF Information Disclosure via Filter Restriction Bypass Date: 09.02.16 Exploit Author: Tal Solomon of Palantir Security Vendor Homepage:...

DLA-435-1 tomcat6 - security update

Bulletin has no description...

Apache Tomcat Security Manager Information Disclosure Vulnerability

Apache Tomcat is a popular open source JSP application server program. Apache Tomcat Security Manager has an information disclosure vulnerability in the implementation of the StatusManagerServlet, which allows attackers to exploit this vulnerability to obtain sensitive information...

SAP NetWeaver Cross-Site Scripting Vulnerability (CNVD-2016-01150)

SAP NetWeaver is SAP SAP company's set of service-oriented integrated application platform. A cross-site scripting vulnerability exists in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver version 7.4. A remote attacker can exploit this vulnerability to inject arbitrary web script or HT...

CVE-2016-2387

CVE-2016-2387 pertains to SAP NetWeaver 7.4, affecting the Java Proxy Runtime ProxyServer servlet. The vulnerability enables cross-site scripting (XSS) via the ProxyServer/register endpoint, by manipulating the ns or interface parameters, as noted in SAP Security Note 2220571. Public advisories (...

Fixed in Apache Tomcat 6.0.45

Low: Limited directory traversal CVE-2015-5174 This issue only affects users running untrusted web applications under a security manager. When accessing resources via the ServletContext methods getResource getResourceAsStream and getResourcePaths the paths should be limited to the current web...

Oracle Application Testing Suite UploadFileAction Servlet Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Application Testing Suite. Authentication is required but can be bypassed. The specific vulnerability is in the UploadFileAction servlet. By providing a fileType parameter of "", an attacker...

Oracle Application Testing Suite Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Oracle Application Testing Suite. The specific flaw exists within the ActionServlet servlet. The process method for this servlet will bypass authentication if the URI starts with a specific string. ...

Oracle Supply Chain Configurator UI Servlet Component Data Access Vulnerability (CNVD-2016-00561)

Oracle Supply Chain Products Suite is a suite of supply chain solutions that provides value chain planning, value chain execution, and product lifecycle management. An unspecified vulnerability exists in the Oracle Supply Chain Configurator UI Servlet component, which allows remote attackers to...

Oracle Supply Chain Configurator UI Servlet Component Data Access Vulnerability

Oracle Supply Chain Products Suite is a suite of supply chain solutions that provides value chain planning, value chain execution, and product lifecycle management. An unspecified security vulnerability exists in the Oracle Supply Chain Configurator UI Servlet component, which allows remote...