CVE-2002-1640

Multiple cross-site scripting XSS vulnerabilities in Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to inject arbitrary web script or HTML via 1 Text Features in the DHTML UI or 2 the test parameter to the oracle.apps.cz.servlet.UiServlet servlet...

CVE-2004-2103

Cross-site scripting XSS vulnerability in Novell NetWare Enterprise Web Server 5.1 and 6.0 allows remote attackers to process arbitrary script or HTML as other users via 1 a malformed request for a Perl program with script in the filename, 2 the User.id parameter to the webacc servlet, 3 the...

CVE-2003-0104

CVE-2003-0104 : Affected software are PeopleTools 8.10–8.18, 8.40, and 8.41. The issue is a directory traversal in the SchedulerTransfer servlet that allows remote attackers to overwrite arbitrary files. The connected documents confirm the vulnerable component and the impact, but do not provide e...

CVE-2002-1148

CVE-2002-1148 refers to a vulnerability in Apache Tomcat where the default servlet (org.apache.catalina.servlets.DefaultServlet) on Tomcat 4.0.4, 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. Connected sources (GHSA and OSS/ID...

CVE-2003-0104

Directory traversal vulnerability in PeopleTools 8.10 through 8.18, 8.40, and 8.41 allows remote attackers to overwrite arbitrary files via the SchedulerTransfer servlet...

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

Apache Tomcat < 3.3.1a Servlet Engine MS/DOS Device Name DoS

Binary data 1467.pasl...

Apache Tomcat Snoop Servlet Remote Information Disclosure

Binary data 1464.prm...

WebLogic Internal Management Servlet Authentication Bypass

Binary data 1455.prm...

thttpd < 2.20 ssi Servlet Traversal File Access

Binary data 1468.prm...

Character not allowed in user name

A user has sign up with the user name "m&m". The i tried to modify this user. Because the username is passed as url parameter FooServlet?name=m&m : GET or POST method the servlet container cut the name and try to retreive the username named "m" !!! The only way is to use a database client, change...

Character not allowed in user name

A user has sign up with the user name "m&m". The i tried to modify this user. Because the username is passed as url parameter FooServlet?name=m&m : GET or POST method the servlet container cut the name and try to retreive the username named "m" !!! The only way is to use a database client, change...

Character not allowed in user name

A user has sign up with the user name "m&m". The i tried to modify this user. Because the username is passed as url parameter FooServlet?name=m&m : GET or POST method the servlet container cut the name and try to retreive the username named "m" !!! The only way is to use a database client, change...

Novell Groupwise Servlet Manager Default Password

The Novell Groupwise servlet server is configured with a default password. As a result, users could be denied access to mail and other servlet based resources. To test this finding: https:///servlet/ServletManager/ enter 'servlet' for the user and 'manager' for the password. This script was writt...

Resin Status Page Information Disclosure

Requesting the URI '/caucho-status' or '/server-status' gives information about the currently running Resin java servlet container. %NASLMINLEVEL 70300 This script was written by Vincent Renardias Licence : GPL v2 Changes by Tenable: - Revised plugin title, family change 4/2/2009...

CVE-2003-0950

CVE-2003-0950 affects PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x. The issue allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet, guessing the directory name (based on system time) used to store the file, and directly requesting that file. The underlyi...

CVE-2003-0628

This CVE affects the PeopleSoft Gateway Administration servlet (gateway.administration) in PeopleTools 8.43 and earlier. An attacker can disclose the full pathnames of server-side include (SSI) files by sending an HTTP request with an invalid value, a path-disclosure vulnerability impacting confi...

ISS Security Brief: PeopleSoft IClient Servlet Remote Command Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Brief November 12, 2003 PeopleSoft IClient Servlet Remote Command Execution Vulnerability Synopsis: ISS X-Force has discovered a flaw in a servlet that is part of the PeopleSoft PeopleTools application framework. PeopleSoft...

security flaw

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

CVE-2002-0569

CVE-2002-0569 affects Oracle 9i Application Server via the XSQLServlet, enabling remote authentication bypass to access configuration files. The core issue is bypassing access restrictions on configuration files through direct requests to XSQLServlet, leading to potential exposure of sensitive fi...