RHQ: ServerInvokerServlet remote code exec

It was discovered that the JBoss Operations Network server did not correctly restrict access to certain remote APIs. A remote, unauthenticated attacker could use this flaw to execute arbitrary Java methods via ServerInvokerServlet or SchedulerService, and possibly exhaust all available disk space...

PT-2015-3799

Name of the Vulnerable Software and Affected Versions New Atlanta BlueDragon versions prior to 7.1.1.18527 Description The issue allows remote attackers to potentially read or delete arbitrary files due to a directory traversal vulnerability in the CFChart servlet. This is achieved by including a...

BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File RetrievalDeletion

BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File RetrievalDeletion Vulnerability title: Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet CVE: CVE-2014-5370 Vendor: New Atlanta Product: BlueDragon CFChart Servlet Affected version: 7.1.1.17759 Fixed version:...

BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File Retrieval/Deletion

Vulnerability title: Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet CVE: CVE-2014-5370 Vendor: New Atlanta Product: BlueDragon CFChart Servlet Affected version: 7.1.1.17759 Fixed version: 7.1.1.18527 Reported by: Mike Westmacott Details: The CFChart servlet of...

BlueDragon CFChart Servlet 7.1.1.17759 Directory Traversal

Vulnerability title: Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet CVE: CVE-2014-5370 Vendor: New Atlanta Product: BlueDragon CFChart Servlet Affected version: 7.1.1.17759 Fixed version: 7.1.1.18527 Reported by: Mike Westmacott Details: The CFChart servlet of...

ManageEngine OpManager APMIntegBusinessViewHandler allDevicesRemoved SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the APMIntegBusinessViewHandler servlet. The issue lies in the failure to...

ManageEngine OpManager FileCollector FILENAME File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the FileCollector servlet. The issue lies in the failure to sanitize the...

ManageEngine OpManager MigrateCentralData zipFileName File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MigrateCentralData servlet. The issue lies in the failure to sanitize the...

JBoss AS versions 3/4/5/6 - Remote Command Execution Exploit

Exploit for multiple platform in category web applications coding: utf-8 JexBoss v1.0. @autor: João Filho Matos Figueiredo email protected Updates: https://github.com/joaomatosf/jexboss Free for distribution and modification, but the authorship should be preserved. import httplib, sys, urllib, os...

Cisco Prime Data Center Network Manager < 7.1(1) Directory Traversal Vulnerability

According to its self-reported version number, the Cisco Prime Data Center Network Manager DCNM installed on the remote host is affected by a directory traversal vulnerability in the fmserver servlet due to improper validation of user-supplied information. An unauthenticated, remote attacker, usi...

Cisco Prime Data Center Network Manager directory traversal

fmserver servlet directory traversal...

Cisco Prime Data Center Network Manager File Information Disclosure Vulnerability (CNVD-2015-02229)

Cisco Prime Data Center Network Manager is is a network management application that helps you effectively implement and manage virtualized data centers. An information disclosure vulnerability exists in Cisco Prime Data Center Network Manager files due to the fmserver servlet in Cisco DCNM failin...

CVE-2015-0666

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager DCNM before 7.11 allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241...

CVE-2015-0666: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager DCNM before 7.11 allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241...

VulnCheck KEV: CVE-2015-0666

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager DCNM allows remote attackers to read arbitrary files...

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

Websense Triton and V-Series CLU Arbitrary Command Execution Vulnerability

Websense TRITON is the Unified Content Architecture for data security. An arbitrary command execution vulnerability exists in the Network Diagnostic Tool CommandLineServlet in the CLU in Websense TRITON AP-WEB 7.8.3 and V-Series appliances, which could allow a remotely authenticated user to execu...

CVE-2015-2683

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions JMX Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmxdynamic...

Command injection

Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions JMX Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmxdynamic...

CVE-2015-2683

Citrix Command Center is affected by CVE-2015-2683 due to improper access restrictions on the Advent JMX Servlet. Affected products are Citrix Command Center 5.1 builds earlier than 35.4 and 5.2 builds earlier than 42.7. The issue allows remote attackers to execute arbitrary code via unspecified ...