CVE-2013-1880

Cross-site scripting XSS vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092...

HP Intelligent Management Center SOM Module Information Disclosure

The HP Intelligent Management Center IMC application running on the remote host is affected by an information disclosure vulnerability in the included IMC Service Operation Management SOM Module, specifically within the FileDownload servlet, due to a failure to require authentication. An...

IBM Rational Focal Point LoginController Servlet Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Rational Focal Point. Authentication is not required to exploit this vulnerability. The specific flaw exists within com.telelogic.focalpoint.pres.controller.LoginController servlet which contai...

CVE-2013-6810

The server in Brocade Network Advisor before 12.1.0, as used in EMC Connectrix Manager Converged Network Edition CMCNE, HP B-series SAN Network Advisor, and possibly other products, allows remote attackers to execute arbitrary code by using a servlet to upload an executable file...

Java based Cross platform malware targeting Apache Tomcat servers in the wild

Takashi Katsuki, a researcher at Antivirus firm Symantec has discovered a new cyber attack ongoing in the wild, targeting an open-source Web server application server Apache Tomcat with a cross platform Java based backdoor that can be used to attack other machines. The malware, dubbed as...

CVE-2013-3030

The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote attackers to cause a denial of service temporary gateway outage via crafted HTTP requests...

Code injection

The servlet gateway in IBM Cognos Business Intelligence 8.4.1 before IF3, 10.1.0 before IF4, 10.1.1 before IF4, 10.2.0 before IF4, 10.2.1 before IF2, and 10.2.1.1 before IF1 allows remote attackers to cause a denial of service temporary gateway outage via crafted HTTP requests...

CVE-2013-3030

The CVE-2013-3030 entry affects IBM Cognos Business Intelligence (BI) and Cognos Analytics platforms. Affected is the servlet gateway in IBM Cognos BI 10.2.1 and earlier (including 8.4.1 before IF3, 10.1.x before various IFs, and 10.2.1.x before IF1/IF2/IF4 as listed). The vulnerability allows re...

Apache Tomcat 5.5.25 - Cross-Site Request Forgery

+--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : Apache Tomcat 5.5.25 CSRF Vulnerabilities Date : 10-24-2013 Author : Ivano Binetti http://ivanobinetti.com Author : Gianmarco Pirozzi...

HP Intelligent Management Center BIMS bimsDownload Information Disclosure (CVE-2013-4823)

An information disclosure vulnerability has been reported in the BIMS add-in module of HP Intelligent Management Center.The vulnerability is due to lack of authentication and insufficient input validation in the bimsDownload servlet when processing HTTP request parameters. Remote attackers can...

CVE-2013-5773

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5.0 allows remote attackers to affect integrity via unknown vectors related to Servlet Runtime...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5.0 allows remote attackers to affect integrity via unknown vectors related to Servlet Runtime...

CVE-2013-5773

Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5.0 allows remote attackers to affect integrity via unknown vectors related to Servlet Runtime...

CVE-2013-5773

CVE-2013-5773 affects Oracle Containers for J2EE within Oracle Fusion Middleware 10.1.3.5.0, with an unspecified integrity impact via Servlet Runtime; the exact vectors are not detailed in the provided documents. One connected source notes an unspecified cross-site scripting issue in Oracle’s J2E...

Hewlett-Packard Intelligent Management Center BIMS bimsDownload Servlet Information Disclosure Vulnerability

This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Hewlett-Packard Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the bimsDownload servlet. Authentication is not...

Hewlett-Packard Intelligent Management Center SOM euAccountService Servlet Authentication Bypass Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SOM's euAccountService servlet. No authentication is required to...

Hewlett-Packard Intelligent Management Center SOM sdFileDownload Servlet Information Disclosure Vulnerability

This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Hewlett-Packard Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the sdFileDownload servlet. Authentication is not...

HP PCM+ AgentController Servlet Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP PCM Plus. Authentication is not required to exploit this vulnerability. The specific flaws exist within the Agent servlet. This servlet is vulnerable to a command injection vulnerability when...

PT-2013-5212 · Hewlett Packard · Hp Procurve Manager +2

Name of the Vulnerable Software and Affected Versions: HP ProCurve Manager versions 3.20 through 4.0 HP PCM+ versions 3.20 through 4.0 Identity Driven Manager version 4.0 Description: The issue allows remote attackers to execute arbitrary commands via a HEAD request. This is related to the Agent...

CVE-2013-1646

Multiple cross-site scripting XSS vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary web script or HTML via 1 invalid JSON data in a mail-sending POST request, 2 an arbitrary parameter to...