Apache Tomcat 4.0/4.1 Servlet Path Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4575/info Apache Tomcat is a servlet container for use with the Java Servlet and JavaServer Pages technologies. Tomcat may be run on most UNIX and Linux variants as well as Microsoft Windows. Apache Tomcat ships with a...

BEA Systems WebLogic Express 3.1.8/4/5 Source Code Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/1378/info Within WebLogic Server and WebLogic Express there are four main java servlets registered to serve different kind of files. A default servlet exists if a requested file does not have an assigned servlet. If an ht...

Tomcat 3.0/3.1 Snoop Servlet Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1532/info A vulnerability exists in the snoop servlet portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent file with the .snp extension, too much information is...

Cisco Collaboration Server 5 XSS, Source Code Disclosure

No description provided by source. Cisco Collaboration Server 5 XSS, Source Code Disclosure Discovered by: s4squatch of SecureState R&D Team www.securestate.com Discovered: 08/26/2008 Note: End of Engineering --...

Allaire JRun 3.0 Servlet DoS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2337/info A denial of service condition exists in the JRun web application server. Requesting multiple malformed URLs by way of the java servlet, will cause the JRun application server to stop responding...

HP AutoPass License Server - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'HP AutoPass License Server File Upload', 'Description' = %q This module exploits a code execution flaw in HP AutoPass License Server...

Bruteforce Attack via Applinks Servlet

An attacker is able to perform bruteforce attacks via the applinks servlet. There is no captcha protection, nor do accounts get locked out after excessive attempts. The attacker can input a username, and perform bruteforce attacks on the login form. The core issue is that there is no login attemp...

Bruteforce Attack via Applinks Servlet

An attacker is able to perform bruteforce attacks via the applinks servlet. There is no captcha protection, nor do accounts get locked out after excessive attempts. The attacker can input a username, and perform bruteforce attacks on the login form. The core issue is that there is no login attemp...

CVE-2014-3428

Cross-site scripting XSS vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to servlet...

Cross site scripting

Cross-site scripting XSS vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to servlet...

CVE-2014-3428

Cross-site scripting XSS vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to servlet...

Yealink VoIP Phones - servlet HTTP Response Splitting

Yealink VoIP Phones - servlet HTTP Response Splitting source: https://www.securityfocus.com/bid/68022/info Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to influence how web...

Command injection

The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via a 1 auth, 2 authsession, 3 authsimple, 4 add, 5 addflat, 6 remove, 7 setpwd, 8 addpermissions, 9 revokepermissions, 10 runAsync, or 11 tsmRequest...

TRSWCM 后台权限绕过以及GETSHELL漏洞

简要描述： TRS WCM大于v6版本中存在此漏洞，v5.X版本不存在。无需登录。 详细说明： 注：该漏洞目前影响大量站点，担心厂商忽略导致漏洞细节提前曝光，请管理员同学转至cncert国家互联网应急中心进行处理，多谢。 在/WEB-INF/web.xml中代码如下： govcontroller com.trs.webframework.controler.servlet.NoLoginServiceControler AllowIP 127.0.0.1 CurrUser admin RedirectURI /center.do govcontroller /govcenter.do...

CVE-2014-0096

Removed by vendor...

CVE-2014-0096

CVE-2014-0096 affects Apache Tomcat: DefaultServlet.jspXXE via XML External Entity in XSLT; tracked in Tomcat 6/7/8 lines (older than 6.0.40, 7.x < 7.0.53, 8.x

UBUNTU-CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a...

CVE-2014-3780

Unspecified vulnerability in Citrix VDI-In-A-Box 5.3.x before 5.3.8 and 5.4.x before 5.4.4 allows remote attackers to bypass authentication via unspecified vectors, related to a Java servlet...

Authentication flaw

Unspecified vulnerability in Citrix VDI-In-A-Box 5.3.x before 5.3.8 and 5.4.x before 5.4.4 allows remote attackers to bypass authentication via unspecified vectors, related to a Java servlet...

CVE-2014-3780

Unspecified vulnerability in Citrix VDI-In-A-Box 5.3.x before 5.3.8 and 5.4.x before 5.4.4 allows remote attackers to bypass authentication via unspecified vectors, related to a Java servlet...